diff options
| author | Jerry Snitselaar | 2013-07-22 21:01:58 +0200 |
|---|---|---|
| committer | David S. Miller | 2013-07-25 01:05:14 +0200 |
| commit | f585a991e1d1612265f0d4e812f77e40dd54975b (patch) | |
| tree | 6a1eb3ded2655de5b3cee3107ebae7eedbbd3309 /net/ipv4/fib_trie.c | |
| parent | mlx5: use after free in mlx5_cmd_comp_handler() (diff) | |
| download | kernel-qcow2-linux-f585a991e1d1612265f0d4e812f77e40dd54975b.tar.gz kernel-qcow2-linux-f585a991e1d1612265f0d4e812f77e40dd54975b.tar.xz kernel-qcow2-linux-f585a991e1d1612265f0d4e812f77e40dd54975b.zip | |
fib_trie: potential out of bounds access in trie_show_stats()
With the <= max condition in the for loop, it will be always go 1
element further than needed. If the condition for the while loop is
never met, then max is MAX_STAT_DEPTH, and for loop will walk off the
end of nodesizes[].
Signed-off-by: Jerry Snitselaar <jerry.snitselaar@oracle.com>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv4/fib_trie.c')
| -rw-r--r-- | net/ipv4/fib_trie.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c index 49616fed9340..108a1e9c9eac 100644 --- a/net/ipv4/fib_trie.c +++ b/net/ipv4/fib_trie.c @@ -2133,7 +2133,7 @@ static void trie_show_stats(struct seq_file *seq, struct trie_stat *stat) max--; pointers = 0; - for (i = 1; i <= max; i++) + for (i = 1; i < max; i++) if (stat->nodesizes[i] != 0) { seq_printf(seq, " %u: %u", i, stat->nodesizes[i]); pointers += (1<<i) * stat->nodesizes[i]; |