From owner-svn-src-head@freebsd.org Tue Sep 1 13:41:15 2020 Return-Path: Delivered-To: svn-src-head@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 42CE73C8A88; Tue, 1 Sep 2020 13:41:15 +0000 (UTC) (envelope-from freebsd@gndrsh.dnsmgr.net) Received: from gndrsh.dnsmgr.net (br1.CN84in.dnsmgr.net [69.59.192.140]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 4BgpBL5Tqgz4X7s; Tue, 1 Sep 2020 13:41:14 +0000 (UTC) (envelope-from freebsd@gndrsh.dnsmgr.net) Received: from gndrsh.dnsmgr.net (localhost [127.0.0.1]) by gndrsh.dnsmgr.net (8.13.3/8.13.3) with ESMTP id 081DfB45037922; Tue, 1 Sep 2020 06:41:11 -0700 (PDT) (envelope-from freebsd@gndrsh.dnsmgr.net) Received: (from freebsd@localhost) by gndrsh.dnsmgr.net (8.13.3/8.13.3/Submit) id 081DfBMb037921; Tue, 1 Sep 2020 06:41:11 -0700 (PDT) (envelope-from freebsd) From: "Rodney W. Grimes" Message-Id: <202009011341.081DfBMb037921@gndrsh.dnsmgr.net> Subject: Re: svn commit: r364989 - head/sys/dev/jedec_dimm In-Reply-To: <5709d5bb-6f52-711b-cc4b-bed175cdb7d8@FreeBSD.org> To: Andriy Gapon Date: Tue, 1 Sep 2020 06:41:11 -0700 (PDT) CC: Eric van Gyzen , src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Reply-To: rgrimes@freebsd.org X-Mailer: ELM [version 2.4ME+ PL121h (25)] MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=US-ASCII X-Rspamd-Queue-Id: 4BgpBL5Tqgz4X7s X-Spamd-Bar: ---- Authentication-Results: mx1.freebsd.org; none X-Spamd-Result: default: False [-4.00 / 15.00]; ASN(0.00)[asn:13868, ipnet:69.59.192.0/19, country:US]; REPLY(-4.00)[] X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.33 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 01 Sep 2020 13:41:15 -0000 > On 31/08/2020 18:03, Eric van Gyzen wrote: > > Author: vangyzen > > Date: Mon Aug 31 15:03:23 2020 > > New Revision: 364989 > > URL: https://svnweb.freebsd.org/changeset/base/364989 > > > > Log: > > jedec_dimm: fix array overrun > > > > Coverity detected the overrunning of sc->part_str. > > > > Submitted by: bret_ketchum@dell.com > > Reported by: Coverity > > MFC after: 2 weeks > > Sponsored by: Dell EMC Isilon > > Differential Revision: https://reviews.freebsd.org/D26145 > > > > Modified: > > head/sys/dev/jedec_dimm/jedec_dimm.c > > > > Modified: head/sys/dev/jedec_dimm/jedec_dimm.c > > ============================================================================== > > --- head/sys/dev/jedec_dimm/jedec_dimm.c Mon Aug 31 14:47:23 2020 (r364988) > > +++ head/sys/dev/jedec_dimm/jedec_dimm.c Mon Aug 31 15:03:23 2020 (r364989) > > @@ -795,7 +795,7 @@ jedec_dimm_field_to_str(struct jedec_dimm_softc *sc, c > > > > /* If we're dealing with ASCII, convert trailing spaces to NULs. */ > > if (ascii) { > > - for (i = dstsz; i > 0; i--) { > > + for (i = dstsz - 1; i > 0; i--) { > > If 'i' is an index into the array, then shouldn't the condition be greater-equal? Looks that way to me too, and this corner case only occurs if the string is all spaces, which is probably rare but may exist. > > > > if (dst[i] == ' ') { > > dst[i] = 0; > > } else if (dst[i] == 0) { > > > > > -- > Andriy Gapon > -- Rod Grimes rgrimes@freebsd.org