Red Hat Bugzilla – Bug 1027905
adcli: technically wrong length checks in binary parsers
Last modified: 2016-11-04 02:21:42 EDT
library/addisco.c has several comparison like the check in this function:
static unsigned short
get_16 (unsigned char **p,
unsigned char *end)
unsigned short val;
if ((*p) + 2 > end)
val = ns_get16 (*p);
(*p) += 2;
The problem is that a pointer that points after the element after the last element in the buffer is invalid. Depending on how this function is call, a smart compiler could optimize away such checks.
The comparison should be written like this:
if (end - (*p) < 2)
Makes sense, but as you noted is non-critical. Bumping to next release. Will fix upstream in the meantime.
Fixed in git master upstream.
This bug was accidentally moved from POST to MODIFIED via an error in automation, please see firstname.lastname@example.org with any questions
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.