summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJohn (J5) Palmieri <johnp@redhat.com>2004-04-23 15:25:16 +0000
committerJohn (J5) Palmieri <johnp@redhat.com>2004-04-23 15:25:16 +0000
commitd839b3d0b42f40f874392f88197e596e9b7d3387 (patch)
tree8a8141dc39b3287a673a4cde198eee2b420cbaff
parentc24e6e11a6f9cabfd0311242f8388c8d82e840dc (diff)
downloaddbus-d839b3d0b42f40f874392f88197e596e9b7d3387.tar.gz
* Fixed buffer overflow cause by not incrementing
the times_we_did_each_thing counter array to reflect the number of random mutation functions we have.
-rw-r--r--ChangeLog7
-rw-r--r--test/break-loader.c7
2 files changed, 11 insertions, 3 deletions
diff --git a/ChangeLog b/ChangeLog
index 04e397e7..33877cea 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2004-04-22 John (J5) Palmieri <johnp@redhat.com>
+ (randomly_do_n_things): tracked down buffer overflow
+ to times_we_did_each_thing array which would chop off
+ the first character of the failure_dir string. Increased
+ the size of the array to 7 to reflect the number of
+ random mutation functions we have.
+
2004-04-21 Kristian Høgsberg <krh@redhat.com>
* dbus/dbus-server-unix.c (unix_finalize): Don't unref
diff --git a/test/break-loader.c b/test/break-loader.c
index a0ac5642..5cdc8654 100644
--- a/test/break-loader.c
+++ b/test/break-loader.c
@@ -454,7 +454,7 @@ randomly_change_one_type (const DBusString *orig_data,
}
}
-static int times_we_did_each_thing[6] = { 0, };
+static int times_we_did_each_thing[7] = { 0, };
static void
randomly_do_n_things (const DBusString *orig_data,
@@ -741,14 +741,15 @@ main (int argc,
return 1;
}
- printf (" did %d random mutations: %d %d %d %d %d %d\n",
+ printf (" did %d random mutations: %d %d %d %d %d %d %d\n",
_DBUS_N_ELEMENTS (times_we_did_each_thing),
times_we_did_each_thing[0],
times_we_did_each_thing[1],
times_we_did_each_thing[2],
times_we_did_each_thing[3],
times_we_did_each_thing[4],
- times_we_did_each_thing[5]);
+ times_we_did_each_thing[5],
+ times_we_did_each_thing[6]);
printf ("Found %d failures with seed %u stored in %s\n",
failures_this_iteration, seed, failure_dir_c);