afsmonitor: Fix multiple NUM_FS_STAT_ENTRIES overflows
authorSimon Wilkinson <sxw@your-file-system.com>
Thu, 28 Feb 2013 17:14:20 +0000 (17:14 +0000)
committerJeffrey Altman <jaltman@your-file-system.com>
Fri, 1 Mar 2013 00:23:47 +0000 (16:23 -0800)
If an array is n elements long, accessing element array[n] is an
overflow. Fix various places where we apply loop bounds incorrectly
using the NUM_FS_STAT_ENTRIES constant.

Caught by coverity (#985570, #985571, #985572)

Change-Id: I8a28f06059771f91415ebc989714929cfd09f296
Reviewed-on: http://gerrit.openafs.org/9315
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Jeffrey Altman <jaltman@your-file-system.com>

src/afsmonitor/afsmonitor.c

index 1f019a6..722d03b 100644 (file)
@@ -1184,8 +1184,8 @@ parse_showEntry(char *a_line)
 
        if (strcasestr(arg2, "_group") != NULL) {
 
-           if (fromIdx < 0 || toIdx < 0 || fromIdx > NUM_FS_STAT_ENTRIES
-               || toIdx > NUM_FS_STAT_ENTRIES)
+           if (fromIdx < 0 || toIdx < 0 || fromIdx >= NUM_FS_STAT_ENTRIES
+               || toIdx >= NUM_FS_STAT_ENTRIES)
                return (-2);
            for (j = fromIdx; j <= toIdx; j++) {
                if (!fs_showFlags[j]) {
@@ -1193,7 +1193,7 @@ parse_showEntry(char *a_line)
                    fs_DisplayItems_count++;
                    fs_showFlags[j] = 1;
                }
-               if (fs_DisplayItems_count > NUM_FS_STAT_ENTRIES) {
+               if (fs_DisplayItems_count >= NUM_FS_STAT_ENTRIES) {
                    fprintf(stderr, "[ %s ] fs_DisplayItems_count ovf\n", rn);
                    return (-3);
                }
@@ -1212,8 +1212,8 @@ parse_showEntry(char *a_line)
 
                if (strcasestr(catName, "_group") != NULL) {
                    if (fromIdx < 0 || toIdx < 0
-                       || fromIdx > NUM_FS_STAT_ENTRIES
-                       || toIdx > NUM_FS_STAT_ENTRIES)
+                       || fromIdx >= NUM_FS_STAT_ENTRIES
+                       || toIdx >= NUM_FS_STAT_ENTRIES)
                        return (-4);
                    for (j = fromIdx; j <= toIdx; j++) {
                        if (!fs_showFlags[j]) {
@@ -1221,7 +1221,7 @@ parse_showEntry(char *a_line)
                            fs_DisplayItems_count++;
                            fs_showFlags[j] = 1;
                        }
-                       if (fs_DisplayItems_count > NUM_FS_STAT_ENTRIES) {
+                       if (fs_DisplayItems_count >= NUM_FS_STAT_ENTRIES) {
                            fprintf(stderr,
                                    "[ %s ] fs_DisplayItems_count ovf\n", rn);
                            return (-5);