From e73905634170b2708386bc0697f87dad1614a4be Mon Sep 17 00:00:00 2001 From: Simon Wilkinson Date: Thu, 28 Feb 2013 17:14:20 +0000 Subject: [PATCH] afsmonitor: Fix multiple NUM_CM_STAT_ENTRIES overflows If an array is n elements long, accessing element array[n] is an overflow. Fix various places where we apply loop bounds incorrectly using the NUM_CM_STAT_ENTRIES constant. Caught by coverity (#985571, #985573) Reviewed-on: http://gerrit.openafs.org/9316 Tested-by: BuildBot Reviewed-by: Jeffrey Altman (cherry picked from commit 3beca62928665868294ec3e9d34ab63b41e12645) Change-Id: Icb2221409d7cd62a7efa229697eeb16146ad3ddd Reviewed-on: http://gerrit.openafs.org/11029 Tested-by: BuildBot Reviewed-by: Andrew Deason Reviewed-by: Benjamin Kaduk Reviewed-by: Chas Williams - CONTRACTOR Reviewed-by: Stephan Wiesand --- src/afsmonitor/afsmonitor.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/src/afsmonitor/afsmonitor.c b/src/afsmonitor/afsmonitor.c index 11c68e21c..7c9d54b6e 100644 --- a/src/afsmonitor/afsmonitor.c +++ b/src/afsmonitor/afsmonitor.c @@ -1301,8 +1301,8 @@ parse_showEntry(char *a_line) if (strcasestr(arg2, "_group") != (char *)NULL) { - if (fromIdx < 0 || toIdx < 0 || fromIdx > NUM_CM_STAT_ENTRIES - || toIdx > NUM_CM_STAT_ENTRIES) + if (fromIdx < 0 || toIdx < 0 || fromIdx >= NUM_CM_STAT_ENTRIES + || toIdx >= NUM_CM_STAT_ENTRIES) return (-10); for (j = fromIdx; j <= toIdx; j++) { if (!cm_showFlags[j]) { @@ -1310,7 +1310,7 @@ parse_showEntry(char *a_line) cm_DisplayItems_count++; cm_showFlags[j] = 1; } - if (cm_DisplayItems_count > NUM_CM_STAT_ENTRIES) { + if (cm_DisplayItems_count >= NUM_CM_STAT_ENTRIES) { fprintf(stderr, "[ %s ] cm_DisplayItems_count ovf\n", rn); return (-11); } @@ -1329,8 +1329,8 @@ parse_showEntry(char *a_line) if (strcasestr(catName, "_group") != NULL) { if (fromIdx < 0 || toIdx < 0 - || fromIdx > NUM_CM_STAT_ENTRIES - || toIdx > NUM_CM_STAT_ENTRIES) + || fromIdx >= NUM_CM_STAT_ENTRIES + || toIdx >= NUM_CM_STAT_ENTRIES) return (-12); for (j = fromIdx; j <= toIdx; j++) { if (!cm_showFlags[j]) { @@ -1338,7 +1338,7 @@ parse_showEntry(char *a_line) cm_DisplayItems_count++; cm_showFlags[j] = 1; } - if (cm_DisplayItems_count > NUM_CM_STAT_ENTRIES) { + if (cm_DisplayItems_count >= NUM_CM_STAT_ENTRIES) { fprintf(stderr, "[ %s ] cm_DisplayItems_count ovf\n", rn); return (-13); -- 2.39.5