Subject: kern/3251: Array bounds violation and pasto in dev/isapnp/isapnp.c
To: None <gnats-bugs@gnats.netbsd.org>
From: Christoph Badura <bad@klicman.de>
List: netbsd-bugs
Date: 02/24/1997 22:09:28
>Number: 3251
>Category: kern
>Synopsis: sc->sc_id[][] has only 9 elements + should assign csum.
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: kern-bug-people (Kernel Bug People)
>State: open
>Class: sw-bug
>Submitter-Id: net
>Arrival-Date: Mon Feb 24 13:20:01 1997
>Last-Modified:
>Originator: Christoph Badura
>Organization:
>Release: 1997-02-22
>Environment:
System: NetBSD klic3.klicman.de 1.2C NetBSD 1.2C (KLIC) #28: Sat Feb 22 20:14:50 MET 1997 bad@klic3.klicman.de:/usr/src/sys/arch/i386/compile/KLIC i386
>Description:
The code that reads the checksum in isapnp_findcard() accesses the
tenth element in sc->sc_id[sc->sc_ncards][] but that array has only nine
elements. Also, the code is supposed to assign csum instead of w.
>How-To-Repeat:
By code inspection.
>Fix:
Patch sys/dev/isapnp/isapnp.c as follows:
Index: isapnp.c
===================================================================
RCS file: /u2/src.master/netbsd/src/sys/dev/isapnp/isapnp.c,v
retrieving revision 1.1.1.2
diff -u -r1.1.1.2 isapnp.c
--- isapnp.c 1997/02/11 23:40:52 1.1.1.2
+++ isapnp.c 1997/02/24 20:54:42
@@ -163,7 +163,7 @@
csum >>= 1;
csum |= neg;
- sc->sc_id[sc->sc_ncards][9] = w;
+ sc->sc_id[sc->sc_ncards][8] = csum;
}
if (csum == v) {
>Audit-Trail:
>Unformatted: