diff options
author | John (J5) Palmieri <johnp@redhat.com> | 2004-04-23 15:25:16 +0000 |
---|---|---|
committer | John (J5) Palmieri <johnp@redhat.com> | 2004-04-23 15:25:16 +0000 |
commit | d839b3d0b42f40f874392f88197e596e9b7d3387 (patch) | |
tree | 8a8141dc39b3287a673a4cde198eee2b420cbaff | |
parent | c24e6e11a6f9cabfd0311242f8388c8d82e840dc (diff) | |
download | dbus-d839b3d0b42f40f874392f88197e596e9b7d3387.tar.gz |
* Fixed buffer overflow cause by not incrementing
the times_we_did_each_thing counter array to reflect
the number of random mutation functions we have.
-rw-r--r-- | ChangeLog | 7 | ||||
-rw-r--r-- | test/break-loader.c | 7 |
2 files changed, 11 insertions, 3 deletions
@@ -1,3 +1,10 @@ +2004-04-22 John (J5) Palmieri <johnp@redhat.com> + (randomly_do_n_things): tracked down buffer overflow + to times_we_did_each_thing array which would chop off + the first character of the failure_dir string. Increased + the size of the array to 7 to reflect the number of + random mutation functions we have. + 2004-04-21 Kristian Høgsberg <krh@redhat.com> * dbus/dbus-server-unix.c (unix_finalize): Don't unref diff --git a/test/break-loader.c b/test/break-loader.c index a0ac5642..5cdc8654 100644 --- a/test/break-loader.c +++ b/test/break-loader.c @@ -454,7 +454,7 @@ randomly_change_one_type (const DBusString *orig_data, } } -static int times_we_did_each_thing[6] = { 0, }; +static int times_we_did_each_thing[7] = { 0, }; static void randomly_do_n_things (const DBusString *orig_data, @@ -741,14 +741,15 @@ main (int argc, return 1; } - printf (" did %d random mutations: %d %d %d %d %d %d\n", + printf (" did %d random mutations: %d %d %d %d %d %d %d\n", _DBUS_N_ELEMENTS (times_we_did_each_thing), times_we_did_each_thing[0], times_we_did_each_thing[1], times_we_did_each_thing[2], times_we_did_each_thing[3], times_we_did_each_thing[4], - times_we_did_each_thing[5]); + times_we_did_each_thing[5], + times_we_did_each_thing[6]); printf ("Found %d failures with seed %u stored in %s\n", failures_this_iteration, seed, failure_dir_c); |