From 4ea1c8440aad6bb6dc9cdb598b5708c685603219 Mon Sep 17 00:00:00 2001 From: Simon Wilkinson Date: Thu, 28 Feb 2013 17:14:20 +0000 Subject: [PATCH] afsmonitor: Fix multiple NUM_FS_STAT_ENTRIES overflows If an array is n elements long, accessing element array[n] is an overflow. Fix various places where we apply loop bounds incorrectly using the NUM_FS_STAT_ENTRIES constant. Caught by coverity (#985570, #985571, #985572) Change-Id: I8a28f06059771f91415ebc989714929cfd09f296 Reviewed-on: http://gerrit.openafs.org/9315 Tested-by: BuildBot Reviewed-by: Jeffrey Altman --- src/afsmonitor/afsmonitor.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/src/afsmonitor/afsmonitor.c b/src/afsmonitor/afsmonitor.c index 1f019a6f1..722d03b41 100644 --- a/src/afsmonitor/afsmonitor.c +++ b/src/afsmonitor/afsmonitor.c @@ -1184,8 +1184,8 @@ parse_showEntry(char *a_line) if (strcasestr(arg2, "_group") != NULL) { - if (fromIdx < 0 || toIdx < 0 || fromIdx > NUM_FS_STAT_ENTRIES - || toIdx > NUM_FS_STAT_ENTRIES) + if (fromIdx < 0 || toIdx < 0 || fromIdx >= NUM_FS_STAT_ENTRIES + || toIdx >= NUM_FS_STAT_ENTRIES) return (-2); for (j = fromIdx; j <= toIdx; j++) { if (!fs_showFlags[j]) { @@ -1193,7 +1193,7 @@ parse_showEntry(char *a_line) fs_DisplayItems_count++; fs_showFlags[j] = 1; } - if (fs_DisplayItems_count > NUM_FS_STAT_ENTRIES) { + if (fs_DisplayItems_count >= NUM_FS_STAT_ENTRIES) { fprintf(stderr, "[ %s ] fs_DisplayItems_count ovf\n", rn); return (-3); } @@ -1212,8 +1212,8 @@ parse_showEntry(char *a_line) if (strcasestr(catName, "_group") != NULL) { if (fromIdx < 0 || toIdx < 0 - || fromIdx > NUM_FS_STAT_ENTRIES - || toIdx > NUM_FS_STAT_ENTRIES) + || fromIdx >= NUM_FS_STAT_ENTRIES + || toIdx >= NUM_FS_STAT_ENTRIES) return (-4); for (j = fromIdx; j <= toIdx; j++) { if (!fs_showFlags[j]) { @@ -1221,7 +1221,7 @@ parse_showEntry(char *a_line) fs_DisplayItems_count++; fs_showFlags[j] = 1; } - if (fs_DisplayItems_count > NUM_FS_STAT_ENTRIES) { + if (fs_DisplayItems_count >= NUM_FS_STAT_ENTRIES) { fprintf(stderr, "[ %s ] fs_DisplayItems_count ovf\n", rn); return (-5); -- 2.39.5