port-vax/41314: missing braces in ncr53c9x.c

[lidl%pix.net@localhost]

>Number:         41314
>Category:       port-vax
>Synopsis:       missing braces in ncr53c9x.c
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    port-vax-maintainer
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri May 01 02:50:00 +0000 2009
>Originator:     Kurt Lidl
>Release:        netbsd-5-RC4
>Organization:
>Environment:
cross-compile of netbsd-5-RC4 from solaris for a vax
I noticed the problem compiling for a vax, but it's
a MI driver.
>Description:
I whacked up a gcc 4.4.1-prerelease to build the netbsd-vax
tree.  (I've not updated to netbsd-5 release, but will soon.)

Anyway, it complains thusly:

#   compile  GENERIC/ncr53c9x.o
/nbsd/vax-5/tools/bin/vax--netbsdelf-gcc -fno-pic -ffreestanding 
-fno-zero-initialized-in-bss -g -pipe -O2 -std=gnu99 -fno-strict-aliasing 
-Werror -Wall -Wno-main -Wno-format-zero-length -Wpointer-arith 
-Wmissing-prototypes -Wstrict-prototypes -Wswitch -Wshadow -Wcast-qual 
-Wwrite-strings -Wno-unreachable-code -Wno-sign-compare -Wno-pointer-sign 
-Wno-attributes -Werror -D_VAX_INLINE_ -I. -I/nbsd/nbsd-5/sys/../common/include 
-I/nbsd/nbsd-5/sys/arch -I/nbsd/nbsd-5/sys -nostdinc -DLKM -DMAXUSERS=8 
-D_KERNEL -D_KERNEL_OPT 
-I/nbsd/nbsd-5/sys/lib/libkern/../../../common/lib/libc/quad 
-I/nbsd/nbsd-5/sys/lib/libkern/../../../common/lib/libc/string 
-I/nbsd/nbsd-5/sys/lib/libkern/../../../common/lib/libc/arch/vax/string 
-I/nbsd/nbsd-5/sys/dist/ipf -c /nbsd/nbsd-5/sys/dev/ic/ncr53c9x.c
cc1: warnings being treated as errors
/nbsd/nbsd-5/sys/dev/ic/ncr53c9x.c: In function 'ncr53c9x_clear':
/nbsd/nbsd-5/sys/dev/ic/ncr53c9x.c:475: error: array subscript is above array 
bounds

>How-To-Repeat:
Do the above compile.

>Fix:
Looking at the code, it appears that a statement was added after
a "for" line, but no set of braces was added too.  I think the following
patch resolves the problem.  Instead of just whacking one value
too far at the end of the array, the array is now nulled out
entirely.

Index: sys/dev/ic/ncr53c9x.c
===================================================================
RCS file: /cvsroot/src/sys/dev/ic/ncr53c9x.c,v
retrieving revision 1.137
diff -u -3 -r1.137 ncr53c9x.c
--- sys/dev/ic/ncr53c9x.c       13 May 2008 22:16:27 -0000      1.137
+++ sys/dev/ic/ncr53c9x.c       30 Apr 2009 02:45:44 -0000
@@ -469,13 +469,14 @@
                                ecb->xs->error = result;
                                ncr53c9x_done(sc, ecb);
                        }
-                       for (i = 0; i < 256; i++)
+                       for (i = 0; i < 256; i++) {
                                ecb = li->queued[i];
                                if (ecb != NULL) {
                                        li->queued[i] = NULL;
                                        ecb->xs->error = result;
                                        ncr53c9x_done(sc, ecb);
                                }
+                       }
                        li->used = 0;
                }
        }