Page MenuHomeFreeBSD

Fix off-by-one bug in btpand
ClosedPublic

Authored by dg612_cam.ac.uk on Jun 2 2024, 9:31 PM.
Tags
None
Referenced Files
F87536262: D45463.diff
Thu, Jul 4, 4:01 PM
Unknown Object (File)
Thu, Jun 27, 5:22 PM
Unknown Object (File)
Tue, Jun 18, 8:55 PM
Unknown Object (File)
Fri, Jun 7, 10:00 AM
Unknown Object (File)
Fri, Jun 7, 7:47 AM
Unknown Object (File)
Fri, Jun 7, 7:47 AM
Unknown Object (File)
Fri, Jun 7, 7:47 AM
Unknown Object (File)
Fri, Jun 7, 7:47 AM
Subscribers

Details

Summary

ul reaches __arraycount(services) before the bound-check happens, causing undefined behaviour.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

dg612_cam.ac.uk created this revision.

Please follow the wiki instructions and be sure to upload full context: https://wiki.freebsd.org/Phabricator#Create_a_Revision_via_Web_Interface

usr.sbin/bluetooth/btpand/btpand.c
146–151

Better as:

			for (ul = 0; ul < __arraycount(services); ul++) {
				if (strcasecmp(optarg, services[ul].name) == 0)
					break;
			}

			if (ul == __arraycount(services))
				errx(EXIT_FAILURE, "%s: unknown service", optarg);

or similar, IMO, as a standard idiom

The update looks good to my eyes

This revision is now accepted and ready to land.Jun 3 2024, 2:38 PM
This revision was automatically updated to reflect the committed changes.