svn commit: r299105 - stable/9/sys/compat/ndis

Pedro F. Giffuni pfg at FreeBSD.org
Thu May 5 01:30:54 UTC 2016


Author: pfg
Date: Thu May  5 01:30:53 2016
New Revision: 299105
URL: https://svnweb.freebsd.org/changeset/base/299105

Log:
  MFC r298731, r298734:
  ndis(4): unsign some indexes to prevent overflows.
  
  The "len" parameter is uint32_t, indexing it with an int may
  end up in a signed integer overflow.
  
  strlen(3) returns an integer of size_t but a correponding index
  of type u_int is more than enough.

Modified:
  stable/9/sys/compat/ndis/subr_ndis.c
Directory Properties:
  stable/9/sys/   (props changed)

Modified: stable/9/sys/compat/ndis/subr_ndis.c
==============================================================================
--- stable/9/sys/compat/ndis/subr_ndis.c	Thu May  5 01:30:00 2016	(r299104)
+++ stable/9/sys/compat/ndis/subr_ndis.c	Thu May  5 01:30:53 2016	(r299105)
@@ -895,7 +895,7 @@ NdisReadPciSlotInformation(adapter, slot
 	uint32_t		len;
 {
 	ndis_miniport_block	*block;
-	int			i;
+	uint32_t		i;
 	char			*dest;
 	device_t		dev;
 
@@ -938,7 +938,7 @@ NdisWritePciSlotInformation(adapter, slo
 	uint32_t		len;
 {
 	ndis_miniport_block	*block;
-	int			i;
+	uint32_t		i;
 	char			*dest;
 	device_t		dev;
 
@@ -2431,7 +2431,7 @@ NdisReadPcmciaAttributeMemory(handle, of
 	bus_space_handle_t	bh;
 	bus_space_tag_t		bt;
 	char			*dest;
-	int			i;
+	uint32_t		i;
 
 	if (handle == NULL)
 		return (0);
@@ -2461,7 +2461,7 @@ NdisWritePcmciaAttributeMemory(handle, o
 	bus_space_handle_t	bh;
 	bus_space_tag_t		bt;
 	char			*src;
-	int			i;
+	uint32_t		i;
 
 	if (handle == NULL)
 		return (0);
@@ -2669,7 +2669,7 @@ ndis_find_sym(lf, filename, suffix, sym)
 {
 	char			*fullsym;
 	char			*suf;
-	int			i;
+	u_int			i;
 
 	fullsym = ExAllocatePoolWithTag(NonPagedPool, MAXPATHLEN, 0);
 	if (fullsym == NULL)


More information about the svn-src-stable-9 mailing list