svn commit: r298328 - head/sys/net

[Conrad E. Meyer]

Author: cem
Date: Wed Apr 20 01:39:31 2016
New Revision: 298328
URL: https://svnweb.freebsd.org/changeset/base/298328

Log:
  bpf_getdltlist: Don't overrun 'lst'
  
  'lst' is allocated with 'n1' members.  'n' indexes 'lst'.  So 'n == n1' is an
  invalid 'lst' index.  This is a follow-up to r296009.
  
  Reported by:	Coverity
  CID:		1352743
  Sponsored by:	EMC / Isilon Storage Division

Modified:
  head/sys/net/bpf.c

Modified: head/sys/net/bpf.c
==============================================================================
--- head/sys/net/bpf.c	Wed Apr 20 01:38:54 2016	(r298327)
+++ head/sys/net/bpf.c	Wed Apr 20 01:39:31 2016	(r298328)
@@ -2739,7 +2739,7 @@ again:
 	LIST_FOREACH(bp, &bpf_iflist, bif_next) {
 		if (bp->bif_ifp != ifp)
 			continue;
-		if (n > n1) {
+		if (n >= n1) {
 			free(lst, M_TEMP);
 			goto again;
 		}