[TALOS-CAN-0052] crash by loop counter underrun.

bk: 560aedcakvkbWlVa-HHrJLJaKw-u7Q

diff --git a/ChangeLog b/ChangeLog
index 6f4c4e268622fdaf117863f831ff58ee72f71283..30944996f826becb2e2c323791fb458b611948f1 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,4 +1,5 @@
 ---
+* [TALOS-CAN-0052] crash by loop counter underrun. perlinger@ntp.org
 * [Bug 2595] ntpdate man page quirks.  Hal Murray, Harlan Stenn.
 * [Bug 2625] Deprecate flag1 in local refclock.  Hal Murray, Harlan Stenn.
 * [Bug 2817] Stop locking ntpd into memory by default under Linux.  H.Stenn.

diff --git a/ntpd/ntp_request.c b/ntpd/ntp_request.c
index 8ffebad328820376973cb9f188155f2d85cabc97..6073f99c456def7f159287926f10e43301fdd1b3 100644 (file)
--- a/ntpd/ntp_request.c
+++ b/ntpd/ntp_request.c
@@ -1757,10 +1757,12 @@ do_restrict(
        }
 
        /*
-        * Looks okay, try it out
+        * Looks okay, try it out.  Needs to reload data pointer and
+        * item counter. (Talos-CAN-0052)
         */
        ZERO_SOCK(&matchaddr);
        ZERO_SOCK(&matchmask);
+       items = INFO_NITEMS(inpkt->err_nitems);
        datap = inpkt->u.data;
 
        while (items-- > 0) {
@@ -1917,9 +1919,11 @@ reset_peer(
        }
 
        /*
-        * Now do it in earnest.
+        * Now do it in earnest. Needs to reload data pointer and item
+        * counter. (Talos-CAN-0052)
         */
-
+       
+       items = INFO_NITEMS(inpkt->err_nitems);
        datap = inpkt->u.data;
        while (items-- > 0) {
                ZERO(cp);