2013-07-22 19:02:30

by Jerry Snitselaar

Subject: [PATCH] fib_trie: potential out of bounds access in trie_show_stats()

With the <= max condition in the for loop, it will be always go 1
element further than needed. If the condition for the while loop is
never met, then max is MAX_STAT_DEPTH, and for loop will walk off the
end of nodesizes[].

Signed-off-by: Jerry Snitselaar <[email protected]>
---
net/ipv4/fib_trie.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 49616fe..108a1e9c 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -2133,7 +2133,7 @@ static void trie_show_stats(struct seq_file *seq, struct trie_stat *stat)
max--;

pointers = 0;
- for (i = 1; i <= max; i++)
+ for (i = 1; i < max; i++)
if (stat->nodesizes[i] != 0) {
seq_printf(seq, " %u: %u", i, stat->nodesizes[i]);
pointers += (1<<i) * stat->nodesizes[i];
--
1.8.3.2.701.g8c4e4ec

2013-07-24 15:00:05

by Hannes Frederic Sowa

Subject: Re: [PATCH] fib_trie: potential out of bounds access in trie_show_stats()

On Mon, Jul 22, 2013 at 12:01:58PM -0700, Jerry Snitselaar wrote:
> With the <= max condition in the for loop, it will be always go 1
> element further than needed. If the condition for the while loop is
> never met, then max is MAX_STAT_DEPTH, and for loop will walk off the
> end of nodesizes[].
>
> Signed-off-by: Jerry Snitselaar <[email protected]>

Acked-by: Hannes Frederic Sowa <[email protected]>

Thanks,

Hannes

2013-07-24 23:05:31

by David Miller

Subject: Re: [PATCH] fib_trie: potential out of bounds access in trie_show_stats()

From: Hannes Frederic Sowa <[email protected]>
Date: Wed, 24 Jul 2013 17:00:00 +0200

> On Mon, Jul 22, 2013 at 12:01:58PM -0700, Jerry Snitselaar wrote:
>> With the <= max condition in the for loop, it will be always go 1
>> element further than needed. If the condition for the while loop is
>> never met, then max is MAX_STAT_DEPTH, and for loop will walk off the
>> end of nodesizes[].
>>
>> Signed-off-by: Jerry Snitselaar <[email protected]>
>
> Acked-by: Hannes Frederic Sowa <[email protected]>

Applied, thanks.