diff options
| author | Jerry Snitselaar <jerry.snitselaar@oracle.com> | 2013-07-22 12:01:58 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2013-07-24 16:05:14 -0700 |
| commit | f585a991e1d1612265f0d4e812f77e40dd54975b (patch) | |
| tree | 6a1eb3ded2655de5b3cee3107ebae7eedbbd3309 /net | |
| parent | 64d2c22a4cdd3ce752ca700964a6120049d78aed (diff) | |
| download | linux-f585a991e1d1612265f0d4e812f77e40dd54975b.tar.gz | |
fib_trie: potential out of bounds access in trie_show_stats()
With the <= max condition in the for loop, it will be always go 1 element further than needed. If the condition for the while loop is never met, then max is MAX_STAT_DEPTH, and for loop will walk off the end of nodesizes[]. Signed-off-by: Jerry Snitselaar <jerry.snitselaar@oracle.com> Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
| -rw-r--r-- | net/ipv4/fib_trie.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c index 49616fed9340..108a1e9c9eac 100644 --- a/net/ipv4/fib_trie.c +++ b/net/ipv4/fib_trie.c @@ -2133,7 +2133,7 @@ static void trie_show_stats(struct seq_file *seq, struct trie_stat *stat) max--; pointers = 0; - for (i = 1; i <= max; i++) + for (i = 1; i < max; i++) if (stat->nodesizes[i] != 0) { seq_printf(seq, " %u: %u", i, stat->nodesizes[i]); pointers += (1<<i) * stat->nodesizes[i]; |