summaryrefslogtreecommitdiff
path: root/net/ipv4
diff options
context:
space:
mode:
authorJerry Snitselaar <jerry.snitselaar@oracle.com>2013-07-22 23:01:58 +0400
committerDavid S. Miller <davem@davemloft.net>2013-07-25 03:05:14 +0400
commitf585a991e1d1612265f0d4e812f77e40dd54975b (patch)
tree6a1eb3ded2655de5b3cee3107ebae7eedbbd3309 /net/ipv4
parent64d2c22a4cdd3ce752ca700964a6120049d78aed (diff)
downloadlinux-f585a991e1d1612265f0d4e812f77e40dd54975b.tar.xz
fib_trie: potential out of bounds access in trie_show_stats()
With the <= max condition in the for loop, it will be always go 1 element further than needed. If the condition for the while loop is never met, then max is MAX_STAT_DEPTH, and for loop will walk off the end of nodesizes[]. Signed-off-by: Jerry Snitselaar <jerry.snitselaar@oracle.com> Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv4')
-rw-r--r--net/ipv4/fib_trie.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 49616fed9340..108a1e9c9eac 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -2133,7 +2133,7 @@ static void trie_show_stats(struct seq_file *seq, struct trie_stat *stat)
max--;
pointers = 0;
- for (i = 1; i <= max; i++)
+ for (i = 1; i < max; i++)
if (stat->nodesizes[i] != 0) {
seq_printf(seq, " %u: %u", i, stat->nodesizes[i]);
pointers += (1<<i) * stat->nodesizes[i];