diff mbox series

[15/20] Fix off-by-one OOB read in elf/tst-tls20

Message ID 728d38c0fe230ac671bd6c2589a11e56f0324644.1666877952.git.szabolcs.nagy@arm.com
State Committed
Commit 6a3794ea917558776ba1a66a925f2d5e1dbf0724
Headers
Series patches from the morello port |

Checks

Context Check Description
dj/TryBot-apply_patch success Patch applied to master at the time it was sent

Commit Message

Szabolcs Nagy Oct. 27, 2022, 3:33 p.m. UTC 
  The int mods[nmods] array on the stack was overread by one.
---
 elf/tst-tls20.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Comments

Florian Weimer Oct. 28, 2022, 5:36 a.m. UTC | #1 
* Szabolcs Nagy via Libc-alpha:

> The int mods[nmods] array on the stack was overread by one.
> ---
>  elf/tst-tls20.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/elf/tst-tls20.c b/elf/tst-tls20.c
> index ce4635eeb1..9cebe22a40 100644
> --- a/elf/tst-tls20.c
> +++ b/elf/tst-tls20.c
> @@ -264,7 +264,7 @@ do_test_dependency (void)
>  	  xdlclose (moddep);
>  	}
>  
> -      for (int n = 1; n <= nmods; n++)
> +      for (int n = 1; n < nmods; n++)
>  	if (mods[n] != 0)
>  	  unload_mod (n);
>      }
> @@ -342,7 +342,7 @@ do_test_invalid_dependency (bool bind_now)
>  	    xdlclose (moddep);
>  	}
>  
> -      for (int n = 1; n <= nmods; n++)
> +      for (int n = 1; n < nmods; n++)
>  	if (mods[n] != 0)
>  	  unload_mod (n);
>      }

Looks good.

Reviewed-by: Florian Weimer <fweimer@redhat.com>

Thanks,
Florian
diff mbox series

Patch

diff --git a/elf/tst-tls20.c b/elf/tst-tls20.c
index ce4635eeb1..9cebe22a40 100644
--- a/elf/tst-tls20.c
+++ b/elf/tst-tls20.c
@@ -264,7 +264,7 @@  do_test_dependency (void)
 	  xdlclose (moddep);
 	}
 
-      for (int n = 1; n <= nmods; n++)
+      for (int n = 1; n < nmods; n++)
 	if (mods[n] != 0)
 	  unload_mod (n);
     }
@@ -342,7 +342,7 @@  do_test_invalid_dependency (bool bind_now)
 	    xdlclose (moddep);
 	}
 
-      for (int n = 1; n <= nmods; n++)
+      for (int n = 1; n < nmods; n++)
 	if (mods[n] != 0)
 	  unload_mod (n);
     }