Skip to content

Commit

Permalink
ipmr: off by one in __ipmr_fill_mroute()
Browse files Browse the repository at this point in the history 
This fixes a smatch warning:
	net/ipv4/ipmr.c +1917 __ipmr_fill_mroute(12) error: buffer overflow
	'(mrt)->vif_table' 32 <= 32

The ipv6 version had the same issue.

Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
  • Loading branch information
Dan Carpenter authored and David S. Miller committed May 26, 2010
1 parent d938a70 commit ed0f160
Show file tree
Hide file tree
Showing 2 changed files with 2 additions and 2 deletions.
2 changes: 1 addition & 1 deletion net/ipv4/ipmr.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1911,7 +1911,7 @@ static int __ipmr_fill_mroute(struct mr_table *mrt, struct sk_buff *skb,
struct rtattr *mp_head;

/* If cache is unresolved, don't try to parse IIF and OIF */
if (c->mfc_parent > MAXVIFS)
if (c->mfc_parent >= MAXVIFS)
return -ENOENT;

if (VIF_EXISTS(mrt, c->mfc_parent))
Expand Down
2 changes: 1 addition & 1 deletion net/ipv6/ip6mr.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2017,7 +2017,7 @@ static int __ip6mr_fill_mroute(struct mr6_table *mrt, struct sk_buff *skb,
struct rtattr *mp_head;

/* If cache is unresolved, don't try to parse IIF and OIF */
if (c->mf6c_parent > MAXMIFS)
if (c->mf6c_parent >= MAXMIFS)
return -ENOENT;

if (MIF_EXISTS(mrt, c->mf6c_parent))
Expand Down

0 comments on commit ed0f160

Please sign in to comment.