ul reaches __arraycount(services) before the bound-check happens, causing undefined behaviour.
Details
Details
Diff Detail
Diff Detail
- Repository
- rG FreeBSD src repository
- Lint
Lint Skipped - Unit
Tests Skipped
Event Timeline
Comment Actions
Please follow the wiki instructions and be sure to upload full context: https://wiki.freebsd.org/Phabricator#Create_a_Revision_via_Web_Interface
| usr.sbin/bluetooth/btpand/btpand.c | ||
|---|---|---|
| 146–151 | Better as: for (ul = 0; ul < __arraycount(services); ul++) {
if (strcasecmp(optarg, services[ul].name) == 0)
break;
}
if (ul == __arraycount(services))
errx(EXIT_FAILURE, "%s: unknown service", optarg);or similar, IMO, as a standard idiom | |