Skip site navigation (1)Skip section navigation (2) 
Date:      Thu, 5 May 2016 01:29:53 +0000 (UTC)
From:      "Pedro F. Giffuni" <pfg@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-10@freebsd.org
Subject:   svn commit: r299103 - stable/10/sys/compat/ndis
Message-ID:  <201605050129.u451Trow008466@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help 
Author: pfg
Date: Thu May  5 01:29:53 2016
New Revision: 299103
URL: https://svnweb.freebsd.org/changeset/base/299103

Log:
  MFC r298731, r298734:
  ndis(4): unsign some indexes to prevent overflows.
  
  The "len" parameter is uint32_t, indexing it with an int may
  end up in a signed integer overflow.
  
  strlen(3) returns an integer of size_t but a correponding index
  of type u_int is more than enough.

Modified:
  stable/10/sys/compat/ndis/subr_ndis.c
Directory Properties:
  stable/10/   (props changed)

Modified: stable/10/sys/compat/ndis/subr_ndis.c
==============================================================================
--- stable/10/sys/compat/ndis/subr_ndis.c	Thu May  5 01:09:30 2016	(r299102)
+++ stable/10/sys/compat/ndis/subr_ndis.c	Thu May  5 01:29:53 2016	(r299103)
@@ -895,7 +895,7 @@ NdisReadPciSlotInformation(adapter, slot
 	uint32_t		len;
 {
 	ndis_miniport_block	*block;
-	int			i;
+	uint32_t		i;
 	char			*dest;
 	device_t		dev;
 
@@ -938,7 +938,7 @@ NdisWritePciSlotInformation(adapter, slo
 	uint32_t		len;
 {
 	ndis_miniport_block	*block;
-	int			i;
+	uint32_t		i;
 	char			*dest;
 	device_t		dev;
 
@@ -2431,7 +2431,7 @@ NdisReadPcmciaAttributeMemory(handle, of
 	bus_space_handle_t	bh;
 	bus_space_tag_t		bt;
 	char			*dest;
-	int			i;
+	uint32_t		i;
 
 	if (handle == NULL)
 		return (0);
@@ -2461,7 +2461,7 @@ NdisWritePcmciaAttributeMemory(handle, o
 	bus_space_handle_t	bh;
 	bus_space_tag_t		bt;
 	char			*src;
-	int			i;
+	uint32_t		i;
 
 	if (handle == NULL)
 		return (0);
@@ -2669,7 +2669,7 @@ ndis_find_sym(lf, filename, suffix, sym)
 {
 	char			*fullsym;
 	char			*suf;
-	int			i;
+	u_int			i;
 
 	fullsym = ExAllocatePoolWithTag(NonPagedPool, MAXPATHLEN, 0);
 	if (fullsym == NULL)

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201605050129.u451Trow008466>