Date: Wed, 20 Apr 2016 01:39:31 +0000 (UTC) From: "Conrad E. Meyer" <cem@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r298328 - head/sys/net Message-ID: <201604200139.u3K1dVgH031280@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: cem Date: Wed Apr 20 01:39:31 2016 New Revision: 298328 URL: https://svnweb.freebsd.org/changeset/base/298328 Log: bpf_getdltlist: Don't overrun 'lst' 'lst' is allocated with 'n1' members. 'n' indexes 'lst'. So 'n == n1' is an invalid 'lst' index. This is a follow-up to r296009. Reported by: Coverity CID: 1352743 Sponsored by: EMC / Isilon Storage Division Modified: head/sys/net/bpf.c Modified: head/sys/net/bpf.c ============================================================================== --- head/sys/net/bpf.c Wed Apr 20 01:38:54 2016 (r298327) +++ head/sys/net/bpf.c Wed Apr 20 01:39:31 2016 (r298328) @@ -2739,7 +2739,7 @@ again: LIST_FOREACH(bp, &bpf_iflist, bif_next) { if (bp->bif_ifp != ifp) continue; - if (n > n1) { + if (n >= n1) { free(lst, M_TEMP); goto again; }
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201604200139.u3K1dVgH031280>