system/freebsd-src
system/freebsd-src
1
0
Fork 0
mirror of https://github.com/freebsd/freebsd-src synced 2024-10-15 12:54:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix undefined behavior when using asmc_fan_getstring()

Browse source 
It was returning a pointer to stack-allocated memory, so make the
allocation at the caller instead.

Found by:	clang static analyzer
Coverity:	CID 1245774
Reviewed by:	ed, rpaulo
Review URL:	https://reviews.freebsd.org/D4740
This commit is contained in:
Ulrich Spörlein 2016-01-05 10:25:22 +00:00
parent 076daeda4f
commit 623534d683
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=293193
1 changed files with 4 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
sys/dev/asmc/asmc.c
View file

@ -963,14 +963,13 @@ asmc_fan_getvalue(device_t dev, const char *key, int fan)
}
static char*
asmc_fan_getstring(device_t dev, const char *key, int fan)
asmc_fan_getstring(device_t dev, const char *key, int fan, uint8_t *buf, uint8_t buflen)
{
uint8_t buf[16];
char fankey[5];
char* desc;
snprintf(fankey, sizeof(fankey), key, fan);
if (asmc_key_read(dev, fankey, buf, sizeof buf) < 0)
if (asmc_key_read(dev, fankey, buf, buflen) < 0)
return (NULL);
desc = buf+4;
@ -1012,12 +1011,13 @@ asmc_mb_sysctl_fanspeed(SYSCTL_HANDLER_ARGS)
static int
asmc_mb_sysctl_fanid(SYSCTL_HANDLER_ARGS)
{
uint8_t buf[16];
device_t dev = (device_t) arg1;
int fan = arg2;
int error = true;
char* desc;
desc = asmc_fan_getstring(dev, ASMC_KEY_FANID, fan);
desc = asmc_fan_getstring(dev, ASMC_KEY_FANID, fan, buf, sizeof(buf));
if (desc != NULL)
error = sysctl_handle_string(oidp, desc, 0, req);