libkmod: hash_del: fix out-of-bounds memory access

Assume bucket->used is 1, and element 0 is deleted. We shouldn't access any
memory above (entry + 1) in this case. Likewise, if bucked->used is 2, only
one element should be shifted, etc.

Fixes: 7db0865 ("Add simple hash implementation")
Signed-off-by: Martin Wilck <martin_wilck@gmx.de>
Reviewed-by: Emil Velikov <emil.l.velikov@gmail.com>
Link: https://github.com/kmod-project/kmod/pull/257
Signed-off-by: Lucas De Marchi <lucas.de.marchi@gmail.com>

diff --git a/shared/hash.c b/shared/hash.c
index 38b7bb30125c034ed300dbf040d8afcd8dfabb8d..158d85d9b6ac3b6043d5be7be8f17c901a88fc52 100644 (file)
--- a/shared/hash.c
+++ b/shared/hash.c
@@ -258,7 +258,7 @@ int hash_del(struct hash *hash, const char *key)
                hash->free_value((void *)entry->value);
 
        entry_end = bucket->entries + bucket->used;
-       memmove(entry, entry + 1, (entry_end - entry) * sizeof(struct hash_entry));
+       memmove(entry, entry + 1, (entry_end - entry - 1) * sizeof(struct hash_entry));
 
        bucket->used--;
        hash->count--;

diff --git a/testsuite/test-hash.c b/testsuite/test-hash.c
index 1ec820d1c47a6270770d1286b72b2614b241e68f..b115a623f55e3716480156965ea703945deb693f 100644 (file)
--- a/testsuite/test-hash.c
+++ b/testsuite/test-hash.c
@@ -184,8 +184,7 @@ static int test_hash_del(const struct test *t)
 
        return 0;
 }
-DEFINE_TEST(test_hash_del, .description = "test add / delete a single element",
-           .expected_fail = true);
+DEFINE_TEST(test_hash_del, .description = "test add / delete a single element");
 
 static int test_hash_free(const struct test *t)
 {