From: Simon Wilkinson <sxw@your-file-system.com>
Date: Thu, 28 Feb 2013 17:14:20 +0000 (+0000)
Subject: afsmonitor: Fix multiple NUM_FS_STAT_ENTRIES overflows
X-Git-Tag: openafs-stable-1_8_0pre1~1379
X-Git-Url: https://git.openafs.org/?p=openafs.git;a=commitdiff_plain;h=4ea1c8440aad6bb6dc9cdb598b5708c685603219

afsmonitor: Fix multiple NUM_FS_STAT_ENTRIES overflows

If an array is n elements long, accessing element array[n] is an
overflow. Fix various places where we apply loop bounds incorrectly
using the NUM_FS_STAT_ENTRIES constant.

Caught by coverity (#985570, #985571, #985572)

Change-Id: I8a28f06059771f91415ebc989714929cfd09f296
Reviewed-on: http://gerrit.openafs.org/9315
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Jeffrey Altman <jaltman@your-file-system.com>
---

diff --git a/src/afsmonitor/afsmonitor.c b/src/afsmonitor/afsmonitor.c
index 1f019a6..722d03b 100644
--- a/src/afsmonitor/afsmonitor.c
+++ b/src/afsmonitor/afsmonitor.c
@@ -1184,8 +1184,8 @@ parse_showEntry(char *a_line)
 
 	if (strcasestr(arg2, "_group") != NULL) {
 
-	    if (fromIdx < 0 || toIdx < 0 || fromIdx > NUM_FS_STAT_ENTRIES
-		|| toIdx > NUM_FS_STAT_ENTRIES)
+	    if (fromIdx < 0 || toIdx < 0 || fromIdx >= NUM_FS_STAT_ENTRIES
+		|| toIdx >= NUM_FS_STAT_ENTRIES)
 		return (-2);
 	    for (j = fromIdx; j <= toIdx; j++) {
 		if (!fs_showFlags[j]) {
@@ -1193,7 +1193,7 @@ parse_showEntry(char *a_line)
 		    fs_DisplayItems_count++;
 		    fs_showFlags[j] = 1;
 		}
-		if (fs_DisplayItems_count > NUM_FS_STAT_ENTRIES) {
+		if (fs_DisplayItems_count >= NUM_FS_STAT_ENTRIES) {
 		    fprintf(stderr, "[ %s ] fs_DisplayItems_count ovf\n", rn);
 		    return (-3);
 		}
@@ -1212,8 +1212,8 @@ parse_showEntry(char *a_line)
 
 		if (strcasestr(catName, "_group") != NULL) {
 		    if (fromIdx < 0 || toIdx < 0
-			|| fromIdx > NUM_FS_STAT_ENTRIES
-			|| toIdx > NUM_FS_STAT_ENTRIES)
+			|| fromIdx >= NUM_FS_STAT_ENTRIES
+			|| toIdx >= NUM_FS_STAT_ENTRIES)
 			return (-4);
 		    for (j = fromIdx; j <= toIdx; j++) {
 			if (!fs_showFlags[j]) {
@@ -1221,7 +1221,7 @@ parse_showEntry(char *a_line)
 			    fs_DisplayItems_count++;
 			    fs_showFlags[j] = 1;
 			}
-			if (fs_DisplayItems_count > NUM_FS_STAT_ENTRIES) {
+			if (fs_DisplayItems_count >= NUM_FS_STAT_ENTRIES) {
 			    fprintf(stderr,
 				    "[ %s ] fs_DisplayItems_count ovf\n", rn);
 			    return (-5);