[src/trunk]: src/sys/dev/ic CID/1203194, CID/1203195: Out of bounds read

[christos <christos%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/f17335eb5869
branches:  trunk
changeset: 328767:f17335eb5869
user:      christos <christos%NetBSD.org@localhost>
date:      Thu Apr 17 16:05:45 2014 +0000

description:
CID/1203194, CID/1203195: Out of bounds read

diffstat:

 sys/dev/ic/mpt_debug.c |  12 ++++++------
 1 files changed, 6 insertions(+), 6 deletions(-)

diffs (44 lines):

diff -r 335d8ea47409 -r f17335eb5869 sys/dev/ic/mpt_debug.c
--- a/sys/dev/ic/mpt_debug.c    Thu Apr 17 16:04:47 2014 +0000
+++ b/sys/dev/ic/mpt_debug.c    Thu Apr 17 16:05:45 2014 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: mpt_debug.c,v 1.9 2014/03/27 18:28:26 christos Exp $   */
+/*     $NetBSD: mpt_debug.c,v 1.10 2014/04/17 16:05:45 christos Exp $  */
 
 /*
  * Copyright (c) 2000, 2001 by Greg Ansley
@@ -35,7 +35,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: mpt_debug.c,v 1.9 2014/03/27 18:28:26 christos Exp $");
+__KERNEL_RCSID(0, "$NetBSD: mpt_debug.c,v 1.10 2014/04/17 16:05:45 christos Exp $");
 
 #include <dev/ic/mpt.h>
 
@@ -201,10 +201,10 @@
                return tbuf;
        while (status->Error_Code >= 0) {
                if ((status->Error_Code & code) != 0) {
+                       if (len >= sizeof(tbuf))
+                               return tbuf;
                        len += snprintf(tbuf + len, sizeof(tbuf) - len, "%s ",
                            status->Error_String);
-                       if (len > sizeof(tbuf))
-                               return tbuf;
                }
                status++;
        }
@@ -248,10 +248,10 @@
                return tbuf;
        while (status->Error_Code >= 0) {
                if ((status->Error_Code & code) != 0) {
+                       if (len >= sizeof(tbuf))
+                               return tbuf;
                        len += snprintf(tbuf + len, sizeof(tbuf) - len, "%s ",
                                status->Error_String);
-                       if (len > sizeof(tbuf))
-                               return tbuf;
                }
                status++;
        }