[src/trunk]: src/sys/arch/x86/acpi CID/1203191: Out of bounds read

[christos <christos%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/bd6e8e96264b
branches:  trunk
changeset: 795526:bd6e8e96264b
user:      christos <christos%NetBSD.org@localhost>
date:      Thu Apr 17 16:01:24 2014 +0000

description:
CID/1203191: Out of bounds read

diffstat:

 sys/arch/x86/acpi/acpi_cpu_md.c |  8 ++++----
 1 files changed, 4 insertions(+), 4 deletions(-)

diffs (32 lines):

diff -r e26813bdba8c -r bd6e8e96264b sys/arch/x86/acpi/acpi_cpu_md.c
--- a/sys/arch/x86/acpi/acpi_cpu_md.c   Thu Apr 17 15:57:41 2014 +0000
+++ b/sys/arch/x86/acpi/acpi_cpu_md.c   Thu Apr 17 16:01:24 2014 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: acpi_cpu_md.c,v 1.76 2014/03/27 18:22:56 christos Exp $ */
+/* $NetBSD: acpi_cpu_md.c,v 1.77 2014/04/17 16:01:24 christos Exp $ */
 
 /*-
  * Copyright (c) 2010, 2011 Jukka Ruohonen <jruohonen%iki.fi@localhost>
@@ -27,7 +27,7 @@
  * SUCH DAMAGE.
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: acpi_cpu_md.c,v 1.76 2014/03/27 18:22:56 christos Exp $");
+__KERNEL_RCSID(0, "$NetBSD: acpi_cpu_md.c,v 1.77 2014/04/17 16:01:24 christos Exp $");
 
 #include <sys/param.h>
 #include <sys/bus.h>
@@ -1150,11 +1150,11 @@
                if (sc->sc_pstate[i].ps_freq == 0)
                        continue;
 
+               if (len >= sizeof(buf))
+                       break;
                len += snprintf(buf + len, sizeof(buf) - len, "%u%s",
                    sc->sc_pstate[i].ps_freq,
                    i < (sc->sc_pstate_count - 1) ? " " : "");
-               if (len > sizeof(buf))
-                       break;
        }
 
        mutex_exit(&sc->sc_mtx);