|
 |
b48781 |
From 968789d5426442ac43b96eabd65f3e5c0c141e62 Mon Sep 17 00:00:00 2001
|
|
|
b48781 |
From: Eugene Syromyatnikov <evgsyr@gmail.com>
|
|
|
b48781 |
Date: Tue, 28 Jun 2022 16:47:56 +0200
|
|
|
b48781 |
Subject: [PATCH] strauss: fix off-by-one error in strauss array access
|
|
|
b48781 |
|
|
|
b48781 |
It has to be limited with strauss_lines - 1, not strauss_lines.
|
|
|
b48781 |
Reported by covscan:
|
|
|
b48781 |
|
|
|
b48781 |
Error: OVERRUN (CWE-119):
|
|
|
b48781 |
strace-5.18/src/strauss.c:380: cond_at_least: Checking "4UL + i < 37UL"
|
|
|
b48781 |
implies that "i" is at least 33 on the false branch.
|
|
|
b48781 |
strace-5.18/src/strauss.c:380: overrun-local: Overrunning array "strauss"
|
|
|
b48781 |
of 37 8-byte elements at element index 37 (byte offset 303) using index
|
|
|
b48781 |
"(4UL + i < 37UL) ? 4UL + i : 37UL" (which evaluates to 37).
|
|
|
b48781 |
|
|
|
b48781 |
* src/strauss.c (print_totd): Limit strauss array accesses to
|
|
|
b48781 |
strauss_lines - 1 instead of strauss_lines.
|
|
|
b48781 |
---
|
|
|
b48781 |
src/strauss.c | 6 +++---
|
|
|
b48781 |
1 file changed, 3 insertions(+), 3 deletions(-)
|
|
|
b48781 |
|
|
|
b48781 |
diff --git a/src/strauss.c b/src/strauss.c
|
|
|
b48781 |
index 98af183..b22ab6a 100644
|
|
|
b48781 |
--- a/src/strauss.c
|
|
|
b48781 |
+++ b/src/strauss.c
|
|
|
b48781 |
@@ -373,16 +373,16 @@ print_totd(void)
|
|
|
b48781 |
tip_left[MIN(i + 1, ARRAY_SIZE(tip_left) - 1)],
|
|
|
b48781 |
w, w, tips_tricks_tweaks[id][i] ?: "",
|
|
|
b48781 |
tip_right[MIN(i + 1, ARRAY_SIZE(tip_right) - 1)],
|
|
|
b48781 |
- strauss[MIN(3 + i, strauss_lines)]);
|
|
|
b48781 |
+ strauss[MIN(3 + i, strauss_lines - 1)]);
|
|
|
b48781 |
}
|
|
|
b48781 |
fprintf(stderr, "%s%s\n",
|
|
|
b48781 |
- tip_bottom, strauss[MIN(3 + i, strauss_lines)]);
|
|
|
b48781 |
+ tip_bottom, strauss[MIN(3 + i, strauss_lines - 1)]);
|
|
|
b48781 |
do {
|
|
|
b48781 |
fprintf(stderr, "%*s%*s%*s%s\n",
|
|
|
b48781 |
(int) strlen(tip_left[0]), "",
|
|
|
b48781 |
w, "",
|
|
|
b48781 |
(int) strlen(tip_right[0]), "",
|
|
|
b48781 |
- strauss[MIN(4 + i, strauss_lines)]);
|
|
|
b48781 |
+ strauss[MIN(4 + i, strauss_lines - 1)]);
|
|
|
b48781 |
} while ((show_tips == TIPS_FULL) && (4 + ++i < strauss_lines));
|
|
|
b48781 |
|
|
|
b48781 |
printed = true;
|
|
|
b48781 |
--
|
|
|
b48781 |
2.1.4
|
|
|
b48781 |
|