diff options
| author | Matthias Schiffer <mschiffer@universe-factory.net> | 2020-05-24 01:13:05 +0200 |
|---|---|---|
| committer | Thomas Haller <thaller@redhat.com> | 2020-05-24 12:15:40 +0200 |
| commit | 2b542020898873e0a67b4ec506546773f5cfd43c (patch) | |
| tree | f86203696267a17ea2329cfed85663adc29bf12f | |
| parent | 41d431e0f844d09d86e17a61bf01d34a2fa41821 (diff) | |
| download | NetworkManager-2b542020898873e0a67b4ec506546773f5cfd43c.tar.gz | |
platform: fix crash in binary search for _link_type_from_rtnl_type(), _link_type_from_devtype()
When searching an element that is lower than the first list element (for
example RTNL type "batadv"), imax will be -1 after the last iteration.
Use int instead of unsigned to make the termination condition imin > imax
work in this case. This fixes NetworkManager crashing due to an
out-of-bounds array access whenever interfaces of such types exist.
Fixes: 19ad044359c4 ('platform: use binary search to lookup NMLinkType for rtnl_type')
https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/515
| -rw-r--r-- | src/platform/nm-linux-platform.c | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/src/platform/nm-linux-platform.c b/src/platform/nm-linux-platform.c index 014cca71da..13eb1e3e34 100644 --- a/src/platform/nm-linux-platform.c +++ b/src/platform/nm-linux-platform.c @@ -726,9 +726,9 @@ _link_type_from_rtnl_type (const char *name) \ } { - unsigned imin = 0; - unsigned imax = (G_N_ELEMENTS (LIST) - 1); - unsigned imid = (G_N_ELEMENTS (LIST) - 1) / 2; + int imin = 0; + int imax = (G_N_ELEMENTS (LIST) - 1); + int imid = (G_N_ELEMENTS (LIST) - 1) / 2; for (;;) { const int cmp = strcmp (link_descs[LIST[imid]].rtnl_type, name); @@ -787,9 +787,9 @@ _link_type_from_devtype (const char *name) \ } { - unsigned imin = 0; - unsigned imax = (G_N_ELEMENTS (LIST) - 1); - unsigned imid = (G_N_ELEMENTS (LIST) - 1) / 2; + int imin = 0; + int imax = (G_N_ELEMENTS (LIST) - 1); + int imid = (G_N_ELEMENTS (LIST) - 1) / 2; for (;;) { const int cmp = strcmp (link_descs[LIST[imid]].devtype, name); |