NetBSD Problem Report #41939

From www@NetBSD.org  Wed Aug 26 06:58:13 2009
Return-Path: <www@NetBSD.org>
Received: from mail.netbsd.org (mail.netbsd.org [204.152.190.11])
	by www.NetBSD.org (Postfix) with ESMTP id 49C9E63BC1D
	for <gnats-bugs@gnats.netbsd.org>; Wed, 26 Aug 2009 06:58:13 +0000 (UTC)
Message-Id: <20090826065813.15A8F63B908@www.NetBSD.org>
Date: Wed, 26 Aug 2009 06:58:13 +0000 (UTC)
From: henning.petersen@t-online.de
Reply-To: henning.petersen@t-online.de
To: gnats-bugs@NetBSD.org
Subject: Fixing order of arguments.
X-Send-Pr-Version: www-1.0

>Number:         41939
>Category:       kern
>Synopsis:       Fixing order of arguments.
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          closed
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Aug 26 07:00:01 +0000 2009
>Closed-Date:    Sun Dec 06 16:46:55 +0000 2009
>Last-Modified:  Sun Dec 06 16:50:02 +0000 2009
>Originator:     Henning Petersen
>Release:        current-NetBSD
>Organization:
>Environment:
>Description:
Fing order of arguments.
Fix from OpenBSD.
>How-To-Repeat:

>Fix:
diff -u -r1.19 pf_if.c
--- sys/dist/pf/net/pf_if.c	28 Jul 2009 18:15:26 -0000	1.19
+++ sys/dist/pf/net/pf_if.c	26 Aug 2009 05:10:34 -0000
@@ -583,7 +583,7 @@
 			    "(%d/%d)\n", pfi_buffer_cnt, PFI_BUFFER_MAX);
 			return;
 		}
-		memcpy(pfi_buffer, p, pfi_buffer_cnt * sizeof(*pfi_buffer));
+		memcpy(p, pfi_buffer, pfi_buffer_max * sizeof(*pfi_buffer));
 		/* no need to zero buffer */
 		free(pfi_buffer, PFI_MTYPE);
 		pfi_buffer = p;

>Release-Note:

>Audit-Trail:
From: David Laight <david@l8s.co.uk>
To: gnats-bugs@NetBSD.org
Cc: 
Subject: Re: kern/41939: Fixing order of arguments.
Date: Sun, 30 Aug 2009 20:20:37 +0100

 On Wed, Aug 26, 2009 at 07:00:01AM +0000, henning.petersen@t-online.de wrote:
 >  		}
 > -		memcpy(pfi_buffer, p, pfi_buffer_cnt * sizeof(*pfi_buffer));
 > +		memcpy(p, pfi_buffer, pfi_buffer_max * sizeof(*pfi_buffer));
 >  		/* no need to zero buffer */
 >  		free(pfi_buffer, PFI_MTYPE);
 >  		pfi_buffer = p;

 I suspect the length of the copy was correct - I guess pfi_buffer_cnt was
 the old number of entries and pfi_buffer_max is the new number.

 	David

 -- 
 David Laight: david@l8s.co.uk

State-Changed-From-To: open->closed
State-Changed-By: dsl@NetBSD.org
State-Changed-When: Sun, 06 Dec 2009 16:46:55 +0000
State-Changed-Why:
code changed to copy in correct direction.


From: David Laight <dsl@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/41939 CVS commit: src/sys/dist/pf/net
Date: Sun, 6 Dec 2009 16:46:12 +0000

 Module Name:	src
 Committed By:	dsl
 Date:		Sun Dec  6 16:46:11 UTC 2009

 Modified Files:
 	src/sys/dist/pf/net: pf_if.c

 Log Message:
 If pfi_address_add() has to extend the buffer, copy the data in the
 right direction!
 Fixes PR/41939.


 To generate a diff of this commit:
 cvs rdiff -u -r1.19 -r1.20 src/sys/dist/pf/net/pf_if.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

>Unformatted:

Home	PR Database Search