lnstat: fix buffer overflow in header output

Running lnstat will cause core dump from reading past end of array.

Segmentation fault (core dumped)

The maximum  value of th.num_lines is HDR_LINES(10),  h should not be equal to th.num_lines, array th.hdr may be out of bounds.

Signed-off-by jiangheng <jiangheng12@huawei.com>
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>

diff --git a/misc/lnstat.c b/misc/lnstat.c
index 89cb0e7e24672aa115709fcfa94be6ac10cf1b10..98904d45e6b43bb7141963fd3cf2558ce4512a8c 100644 (file)
--- a/misc/lnstat.c
+++ b/misc/lnstat.c
@@ -210,8 +210,9 @@ static struct table_hdr *build_hdr_string(struct lnstat_file *lnstat_files,
                }
                ofs += width+1;
        }
+
        /* fill in spaces */
-       for (h = 1; h <= th.num_lines; h++) {
+       for (h = 1; h < th.num_lines; h++) {
                for (i = 0; i < ofs; i++) {
                        if (th.hdr[h][i] == '\0')
                                th.hdr[h][i] = ' ';