Commit f585a991 authored Jul 22, 2013 by Jerry Snitselaar Committed by David S. Miller Jul 24, 2013

fib_trie: potential out of bounds access in trie_show_stats()



With the <= max condition in the for loop, it will be always go 1
element further than needed. If the condition for the while loop is
never met, then max is MAX_STAT_DEPTH, and for loop will walk off the
end of nodesizes[].

Signed-off-by: Jerry Snitselaar <jerry.snitselaar@oracle.com>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 64d2c22a

net/ipv4/fib_trie.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -2133,7 +2133,7 @@ static void trie_show_stats(struct seq_file seq, struct trie_stat stat)
		max--;

		pointers = 0;
		for (i = 1; i <= max; i++)
		for (i = 1; i < max; i++)
		if (stat->nodesizes[i] != 0) {
		seq_printf(seq, " %u: %u", i, stat->nodesizes[i]);
		pointers += (1<<i) * stat->nodesizes[i];