Make the range test legible; in the process, uncover and close

a bounds overflow condition. [wrowe]
Backports: r417252

Simplify and correctly range test lb_num. [jorton]
Discovered by Hisanobu Okuda
(No prior commit no)

Reviewed by: jorton, wrowe, ylavic

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@1799356 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/server/scoreboard.c b/server/scoreboard.c
index 0ff316047591f5b68e4e30d97e0c169d17ef30f0..f2dc7180c347ad255d469f42a0d5bbd681f0493a 100644 (file)
--- a/server/scoreboard.c
+++ b/server/scoreboard.c
@@ -503,8 +503,8 @@ void ap_time_process_request(ap_sb_handle_t *sbh, int status)
 
 AP_DECLARE(worker_score *) ap_get_scoreboard_worker(int x, int y)
 {
-    if (((x < 0) || (server_limit < x)) ||
-        ((y < 0) || (thread_limit < y))) {
+    if (((x < 0) || (x >= server_limit)) ||
+        ((y < 0) || (y >= thread_limit))) {
         return(NULL); /* Out of range */
     }
     return &ap_scoreboard_image->servers[x][y];
@@ -527,7 +527,7 @@ AP_DECLARE(void) ap_copy_scoreboard_worker(worker_score *dest,
 
 AP_DECLARE(process_score *) ap_get_scoreboard_process(int x)
 {
-    if ((x < 0) || (server_limit < x)) {
+    if ((x < 0) || (x >= server_limit)) {
         return(NULL); /* Out of range */
     }
     return &ap_scoreboard_image->parent[x];
@@ -540,7 +540,7 @@ AP_DECLARE(global_score *) ap_get_scoreboard_global()
 
 AP_DECLARE(lb_score *) ap_get_scoreboard_lb(int lb_num)
 {
-    if (((lb_num < 0) || (lb_limit < lb_num))) {
+    if ((lb_num < 0) || (lb_num >= lb_limit)) {
         return(NULL); /* Out of range */
     }
     return &ap_scoreboard_image->balancers[lb_num];