From: Szabolcs Nagy <szabolcs.nagy@arm.com>
Date: Tue, 11 Oct 2022 12:07:59 +0000 (+0100)
Subject: Fix off-by-one OOB read in elf/tst-tls20
X-Git-Tag: glibc-2.37~208
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6a3794ea917558776ba1a66a925f2d5e1dbf0724;p=thirdparty%2Fglibc.git

Fix off-by-one OOB read in elf/tst-tls20

The int mods[nmods] array on the stack was overread by one.

Reviewed-by: Florian Weimer <fweimer@redhat.com>
---

diff --git a/elf/tst-tls20.c b/elf/tst-tls20.c
index ce4635eeb1a..9cebe22a402 100644
--- a/elf/tst-tls20.c
+++ b/elf/tst-tls20.c
@@ -264,7 +264,7 @@ do_test_dependency (void)
 	  xdlclose (moddep);
 	}
 
-      for (int n = 1; n <= nmods; n++)
+      for (int n = 1; n < nmods; n++)
 	if (mods[n] != 0)
 	  unload_mod (n);
     }
@@ -342,7 +342,7 @@ do_test_invalid_dependency (bool bind_now)
 	    xdlclose (moddep);
 	}
 
-      for (int n = 1; n <= nmods; n++)
+      for (int n = 1; n < nmods; n++)
 	if (mods[n] != 0)
 	  unload_mod (n);
     }