From owner-svn-src-stable-10@FreeBSD.ORG Thu Aug 28 18:11:06 2014 Return-Path: Delivered-To: svn-src-stable-10@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 515E092A; Thu, 28 Aug 2014 18:11:06 +0000 (UTC) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 21ECA1B06; Thu, 28 Aug 2014 18:11:06 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.9/8.14.9) with ESMTP id s7SIB6gk089432; Thu, 28 Aug 2014 18:11:06 GMT (envelope-from pfg@FreeBSD.org) Received: (from pfg@localhost) by svn.freebsd.org (8.14.9/8.14.9/Submit) id s7SIB5oh089427; Thu, 28 Aug 2014 18:11:05 GMT (envelope-from pfg@FreeBSD.org) Message-Id: <201408281811.s7SIB5oh089427@svn.freebsd.org> X-Authentication-Warning: svn.freebsd.org: pfg set sender to pfg@FreeBSD.org using -f From: "Pedro F. Giffuni" Date: Thu, 28 Aug 2014 18:11:05 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-10@freebsd.org Subject: svn commit: r270756 - in stable/10: bin/ed libexec/rtld-elf usr.bin/mail X-SVN-Group: stable-10 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-stable-10@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: SVN commit messages for only the 10-stable src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 Aug 2014 18:11:06 -0000 Author: pfg Date: Thu Aug 28 18:11:05 2014 New Revision: 270756 URL: http://svnweb.freebsd.org/changeset/base/270756 Log: MFC r270256: Always check the limits of array index variables before using them. Obtained from: DragonFlyBSD Modified: stable/10/bin/ed/cbc.c stable/10/libexec/rtld-elf/libmap.c stable/10/usr.bin/mail/edit.c Directory Properties: stable/10/ (props changed) Modified: stable/10/bin/ed/cbc.c ============================================================================== --- stable/10/bin/ed/cbc.c Thu Aug 28 17:40:19 2014 (r270755) +++ stable/10/bin/ed/cbc.c Thu Aug 28 18:11:05 2014 (r270756) @@ -237,7 +237,7 @@ expand_des_key(char *obuf, char *kbuf) /* * now translate it, bombing on any illegal hex digit */ - for (i = 0; kbuf[i] && i < 16; i++) + for (i = 0; i < 16 && kbuf[i]; i++) if ((nbuf[i] = hex_to_binary((int) kbuf[i], 16)) == -1) des_error("bad hex digit in key"); while (i < 16) Modified: stable/10/libexec/rtld-elf/libmap.c ============================================================================== --- stable/10/libexec/rtld-elf/libmap.c Thu Aug 28 17:40:19 2014 (r270755) +++ stable/10/libexec/rtld-elf/libmap.c Thu Aug 28 18:11:05 2014 (r270756) @@ -216,14 +216,14 @@ lmc_parse(char *lm_p, size_t lm_len) p = NULL; while (cnt < lm_len) { i = 0; - while (lm_p[cnt] != '\n' && cnt < lm_len && + while (cnt < lm_len && lm_p[cnt] != '\n' && i < sizeof(line) - 1) { line[i] = lm_p[cnt]; cnt++; i++; } line[i] = '\0'; - while (lm_p[cnt] != '\n' && cnt < lm_len) + while (cnt < lm_len && lm_p[cnt] != '\n') cnt++; /* skip over nl */ cnt++; Modified: stable/10/usr.bin/mail/edit.c ============================================================================== --- stable/10/usr.bin/mail/edit.c Thu Aug 28 17:40:19 2014 (r270755) +++ stable/10/usr.bin/mail/edit.c Thu Aug 28 18:11:05 2014 (r270756) @@ -81,7 +81,7 @@ edit1(int *msgvec, int type) /* * Deal with each message to be edited . . . */ - for (i = 0; msgvec[i] && i < msgCount; i++) { + for (i = 0; i < msgCount && msgvec[i]; i++) { sig_t sigint; if (i > 0) {