[src/trunk]: src/sys/dev/pci CID 1271021: Overrunning array "in->in_ridx" of ...

[nonaka <nonaka%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/d505c1ddca77
branches:  trunk
changeset: 336274:d505c1ddca77
user:      nonaka <nonaka%NetBSD.org@localhost>
date:      Mon Feb 23 13:09:37 2015 +0000

description:
CID 1271021: Overrunning array "in->in_ridx" of 15 bytes at byte offset 15 using index "i" (which evaluates to 15).

http://mail-index.netbsd.org/coverity-updates/2015/02/21/msg000115.html

diffstat:

 sys/dev/pci/if_iwm.c |  10 +++++++---
 1 files changed, 7 insertions(+), 3 deletions(-)

diffs (32 lines):

diff -r f79d6b1d431c -r d505c1ddca77 sys/dev/pci/if_iwm.c
--- a/sys/dev/pci/if_iwm.c      Mon Feb 23 13:01:35 2015 +0000
+++ b/sys/dev/pci/if_iwm.c      Mon Feb 23 13:09:37 2015 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: if_iwm.c,v 1.11 2015/02/20 16:16:06 nonaka Exp $       */
+/*     $NetBSD: if_iwm.c,v 1.12 2015/02/23 13:09:37 nonaka Exp $       */
 /*     OpenBSD: if_iwm.c,v 1.18 2015/02/11 01:12:42 brad Exp   */
 
 /*
@@ -105,7 +105,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_iwm.c,v 1.11 2015/02/20 16:16:06 nonaka Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_iwm.c,v 1.12 2015/02/23 13:09:37 nonaka Exp $");
 
 #include <sys/param.h>
 #include <sys/conf.h>
@@ -5347,8 +5347,12 @@
                if (ridx > IWM_RIDX_MAX)
                        DPRINTF(("%s: WARNING: device rate for %d not found!\n",
                            DEVNAME(sc), rate));
+               else if (i < __arraycount(in->in_ridx))
+                       in->in_ridx[i] = ridx;
                else
-                       in->in_ridx[i] = ridx;
+                       DPRINTF(("%s: WARNING: out of range: "
+                           "i(%d) >= array size(%zu)\n", DEVNAME(sc),
+                           i, __arraycount(in->in_ridx)));
        }
 
        /* then construct a lq_cmd based on those */