NetBSD Problem Report #50756

From www@NetBSD.org  Wed Feb  3 09:58:06 2016
Return-Path: <www@NetBSD.org>
Received: from mail.netbsd.org (mail.NetBSD.org [199.233.217.200])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(Client CN "mail.netbsd.org", Issuer "Postmaster NetBSD.org" (verified OK))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 8D98E7ABF4
	for <gnats-bugs@gnats.NetBSD.org>; Wed,  3 Feb 2016 09:58:06 +0000 (UTC)
Message-Id: <20160203095805.AEE427ACB3@mollari.NetBSD.org>
Date: Wed,  3 Feb 2016 09:58:05 +0000 (UTC)
From: dcb314@hotmail.com
Reply-To: dcb314@hotmail.com
To: gnats-bugs@NetBSD.org
Subject: src/sbin/gpt/show.c:117: array index out of range ?
X-Send-Pr-Version: www-1.0

>Number:         50756
>Category:       bin
>Synopsis:       src/sbin/gpt/show.c:117: array index out of range ?
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    bin-bug-people
>State:          closed
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Feb 03 10:00:00 +0000 2016
>Closed-Date:    Tue May 31 02:30:49 +0000 2016
>Last-Modified:  Tue May 31 02:30:49 +0000 2016
>Originator:     David Binderman
>Release:        cvs dated 20160203
>Organization:
>Environment:
>Description:
[src/sbin/gpt/show.c:117]: (error) Array 'mbr.mbr_part[4]' accessed at index 4, which is out of bounds.

Source code is

        for (i = 0; i < 4; i++) {
            start = le16toh(mbr->mbr_part[i].part_start_hi);
            start = (start << 16) +
                le16toh(mbr->mbr_part[i].part_start_lo);
            if (map_start == p->map_start + start)
                break;
        }
        printf("%d", mbr->mbr_part[i].part_typ);

The code seems to assume success i.e. the break is always executed.

Maybe it would be a good idea to add some code for the failure case i.e.
the loop executes four times without finding what it is looking for.

>How-To-Repeat:

>Fix:

>Release-Note:

>Audit-Trail:
From: "David A. Holland" <dholland@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/50756 CVS commit: src/sbin/gpt
Date: Tue, 31 May 2016 02:29:54 +0000

 Module Name:	src
 Committed By:	dholland
 Date:		Tue May 31 02:29:54 UTC 2016

 Modified Files:
 	src/sbin/gpt: show.c

 Log Message:
 PR 50756 David Binderman: avoid running off the end of an array in case
 thing we're looking for isn't there. Which is probably impossible, but
 that's not obvious.


 To generate a diff of this commit:
 cvs rdiff -u -r1.35 -r1.36 src/sbin/gpt/show.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: open->closed
State-Changed-By: dholland@NetBSD.org
State-Changed-When: Tue, 31 May 2016 02:30:49 +0000
State-Changed-Why:
fixed, thanks


>Unformatted:

Home	PR Database Search