afsmonitor: Fix multiple NUM_CM_STAT_ENTRIES overflows

If an array is n elements long, accessing element array[n] is an
overflow. Fix various places where we apply loop bounds incorrectly
using the NUM_CM_STAT_ENTRIES constant.

Caught by coverity (#985571, #985573)

Reviewed-on: http://gerrit.openafs.org/9316
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Jeffrey Altman <jaltman@your-file-system.com>
(cherry picked from commit 3beca62928665868294ec3e9d34ab63b41e12645)

Change-Id: Icb2221409d7cd62a7efa229697eeb16146ad3ddd
Reviewed-on: http://gerrit.openafs.org/11029
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Andrew Deason <adeason@sinenomine.net>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Reviewed-by: Chas Williams - CONTRACTOR <chas@cmf.nrl.navy.mil>
Reviewed-by: Stephan Wiesand <stephan.wiesand@desy.de>

diff --git a/src/afsmonitor/afsmonitor.c b/src/afsmonitor/afsmonitor.c
index 11c68e21c1387e8b5c915f2e12ff4de07e73c0cd..7c9d54b6e88b3499d2568019459642ab7046621a 100644 (file)
--- a/src/afsmonitor/afsmonitor.c
+++ b/src/afsmonitor/afsmonitor.c
@@ -1301,8 +1301,8 @@ parse_showEntry(char *a_line)
 
        if (strcasestr(arg2, "_group") != (char *)NULL) {
 
-           if (fromIdx < 0 || toIdx < 0 || fromIdx > NUM_CM_STAT_ENTRIES
-               || toIdx > NUM_CM_STAT_ENTRIES)
+           if (fromIdx < 0 || toIdx < 0 || fromIdx >= NUM_CM_STAT_ENTRIES
+               || toIdx >= NUM_CM_STAT_ENTRIES)
                return (-10);
            for (j = fromIdx; j <= toIdx; j++) {
                if (!cm_showFlags[j]) {
@@ -1310,7 +1310,7 @@ parse_showEntry(char *a_line)
                    cm_DisplayItems_count++;
                    cm_showFlags[j] = 1;
                }
-               if (cm_DisplayItems_count > NUM_CM_STAT_ENTRIES) {
+               if (cm_DisplayItems_count >= NUM_CM_STAT_ENTRIES) {
                    fprintf(stderr, "[ %s ] cm_DisplayItems_count ovf\n", rn);
                    return (-11);
                }
@@ -1329,8 +1329,8 @@ parse_showEntry(char *a_line)
 
                if (strcasestr(catName, "_group") != NULL) {
                    if (fromIdx < 0 || toIdx < 0
-                       || fromIdx > NUM_CM_STAT_ENTRIES
-                       || toIdx > NUM_CM_STAT_ENTRIES)
+                       || fromIdx >= NUM_CM_STAT_ENTRIES
+                       || toIdx >= NUM_CM_STAT_ENTRIES)
                        return (-12);
                    for (j = fromIdx; j <= toIdx; j++) {
                        if (!cm_showFlags[j]) {
@@ -1338,7 +1338,7 @@ parse_showEntry(char *a_line)
                            cm_DisplayItems_count++;
                            cm_showFlags[j] = 1;
                        }
-                       if (cm_DisplayItems_count > NUM_CM_STAT_ENTRIES) {
+                       if (cm_DisplayItems_count >= NUM_CM_STAT_ENTRIES) {
                            fprintf(stderr,
                                    "[ %s ] cm_DisplayItems_count ovf\n", rn);
                            return (-13);