Skip site navigation (1)Skip section navigation (2)
Date:      Mon, 31 Aug 2020 22:27:27 -0700
From:      Ravi Pokala <rpokala@freebsd.org>
To:        Eric van Gyzen <vangyzen@FreeBSD.org>, <src-committers@freebsd.org>, <svn-src-all@freebsd.org>, <svn-src-head@freebsd.org>, <bret_ketchum@dell.com>
Subject:   Re: svn commit: r364989 - head/sys/dev/jedec_dimm
Message-ID:  <E2797720-5103-4802-BD82-CBC8ABA4673E@panasas.com>
In-Reply-To: <202008311503.07VF3OrC097327@repo.freebsd.org>
References:  <202008311503.07VF3OrC097327@repo.freebsd.org>

next in thread | previous in thread | raw e-mail | index | archive | help
-----Original Message-----
From: <owner-src-committers@freebsd.org> on behalf of Eric van Gyzen <vangyzen@FreeBSD.org>
Date: 2020-08-31, Monday at 08:03
To: <src-committers@freebsd.org>, <svn-src-all@freebsd.org>, <svn-src-head@freebsd.org>
Subject: svn commit: r364989 - head/sys/dev/jedec_dimm

    Author: vangyzen
    Date: Mon Aug 31 15:03:23 2020
    New Revision: 364989
    URL: https://svnweb.freebsd.org/changeset/base/364989

    Log:
      jedec_dimm: fix array overrun

      Coverity detected the overrunning of sc->part_str.

      Submitted by:	bret_ketchum@dell.com
      Reported by:	Coverity
      MFC after:	2 weeks
      Sponsored by:	Dell EMC Isilon
      Differential Revision:	https://reviews.freebsd.org/D26145

Pointy-hat to: rpokala@

Bah, sorry, I completely missed this review. <facepalm>

Thanks for the fix, Bret. Thanks for reviewing and committing it, Eric.

-Ravi (rpokala@)

    Modified:
      head/sys/dev/jedec_dimm/jedec_dimm.c

    Modified: head/sys/dev/jedec_dimm/jedec_dimm.c
    ==============================================================================
    --- head/sys/dev/jedec_dimm/jedec_dimm.c	Mon Aug 31 14:47:23 2020	(r364988)
    +++ head/sys/dev/jedec_dimm/jedec_dimm.c	Mon Aug 31 15:03:23 2020	(r364989)
    @@ -795,7 +795,7 @@ jedec_dimm_field_to_str(struct jedec_dimm_softc *sc, c

     	/* If we're dealing with ASCII, convert trailing spaces to NULs. */
     	if (ascii) {
    -		for (i = dstsz; i > 0; i--) {
    +		for (i = dstsz - 1; i > 0; i--) {
     			if (dst[i] == ' ') {
     				dst[i] = 0;
     			} else if (dst[i] == 0) {





Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?E2797720-5103-4802-BD82-CBC8ABA4673E>