diff options
| author | ngie <ngie@FreeBSD.org> | 2016-07-08 20:39:37 +0000 |
|---|---|---|
| committer | ngie <ngie@FreeBSD.org> | 2016-07-08 20:39:37 +0000 |
| commit | 7a6ae0468c49830719b2f15365e4d729b4f7361b (patch) | |
| tree | 9278e9b36e625cd581d98e06fb357fea6f2e8ba4 /usr.sbin | |
| parent | 450eb8400182e87c121f9f0746d9d8fa7f2cb04d (diff) | |
| download | FreeBSD-src-7a6ae0468c49830719b2f15365e4d729b4f7361b.zip FreeBSD-src-7a6ae0468c49830719b2f15365e4d729b4f7361b.tar.gz | |
MFC r301605:
Bounds check rpcbs_rmtcall(..) to ensure rtype is less than RPCBVERS_STAT
Not returning if rtype == RPCBVERS_STAT will cause us to overrun the inf array, as
it's defined to be exactly RPCBVERS_STAT elements in rpcb_prot.x:
> include/rpc/rpcb_prot.x:typedef rpcb_stat rpcb_stat_byvers[RPCBVERS_STAT];
The proposed change also matches the rest of the rtype upper bound checks in the
file, so the original change was likely a typo.
CID: 1007567
Diffstat (limited to 'usr.sbin')
| -rw-r--r-- | usr.sbin/rpcbind/rpcb_stat.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/usr.sbin/rpcbind/rpcb_stat.c b/usr.sbin/rpcbind/rpcb_stat.c index 3061754..56485ca 100644 --- a/usr.sbin/rpcbind/rpcb_stat.c +++ b/usr.sbin/rpcbind/rpcb_stat.c @@ -152,7 +152,7 @@ rpcbs_rmtcall(rpcvers_t rtype, rpcproc_t rpcbproc, rpcprog_t prog, rpcbs_rmtcalllist *rl; struct netconfig *nconf; - if (rtype > RPCBVERS_STAT) + if (rtype >= RPCBVERS_STAT) return; for (rl = inf[rtype].rmtinfo; rl; rl = rl->next) { |
