diff options
| author |   mestre <mestre@openbsd.org> | 2017-08-22 08:49:23 +0000 |
|---|---|---|
| committer | mestre <mestre@openbsd.org> | 2017-08-22 08:49:23 +0000 |
| commit | 69aafab67f12840d249cbcaa5da0d31a42e7bd1c (patch) | |
| tree | a954e63ee7318174c253766ab1d768c5e18d7427 /sys/kern/uipc_socket.c | |
| parent | sync (diff) | |
| download | wireguard-openbsd-69aafab67f12840d249cbcaa5da0d31a42e7bd1c.tar.xz wireguard-openbsd-69aafab67f12840d249cbcaa5da0d31a42e7bd1c.zip | |
Fix off by one overwrite. Covery CID 1452938.
ee->ee_ctls evaluates to either 16 or 32 depending on the card's EEPROM version
and with the current loop condition it will write out of bounds in the second
ee->ee_ctls assignment once the condition is either i < 16 or i < 32.
OK stsp@ and tb@
Diffstat (limited to 'sys/kern/uipc_socket.c')
0 files changed, 0 insertions, 0 deletions