From: Juergen Perlinger <perlinger@ntp.org>
Date: Tue, 29 Sep 2015 20:00:10 +0000 (+0200)
Subject: [TALOS-CAN-0052] crash by loop counter underrun.
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=2f0d5d6037ee0bff89e14eaefc79f53a3116b63b;p=thirdparty%2Fntp.git

[TALOS-CAN-0052] crash by loop counter underrun.

bk: 560aedcakvkbWlVa-HHrJLJaKw-u7Q
---

diff --git a/ChangeLog b/ChangeLog
index 6f4c4e268..30944996f 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,4 +1,5 @@
 ---
+* [TALOS-CAN-0052] crash by loop counter underrun. perlinger@ntp.org
 * [Bug 2595] ntpdate man page quirks.  Hal Murray, Harlan Stenn.
 * [Bug 2625] Deprecate flag1 in local refclock.  Hal Murray, Harlan Stenn.
 * [Bug 2817] Stop locking ntpd into memory by default under Linux.  H.Stenn.
diff --git a/ntpd/ntp_request.c b/ntpd/ntp_request.c
index 8ffebad32..6073f99c4 100644
--- a/ntpd/ntp_request.c
+++ b/ntpd/ntp_request.c
@@ -1757,10 +1757,12 @@ do_restrict(
 	}
 
 	/*
-	 * Looks okay, try it out
+	 * Looks okay, try it out.  Needs to reload data pointer and
+	 * item counter. (Talos-CAN-0052)
 	 */
 	ZERO_SOCK(&matchaddr);
 	ZERO_SOCK(&matchmask);
+	items = INFO_NITEMS(inpkt->err_nitems);
 	datap = inpkt->u.data;
 
 	while (items-- > 0) {
@@ -1917,9 +1919,11 @@ reset_peer(
 	}
 
 	/*
-	 * Now do it in earnest.
+	 * Now do it in earnest. Needs to reload data pointer and item
+	 * counter. (Talos-CAN-0052)
 	 */
-
+	
+	items = INFO_NITEMS(inpkt->err_nitems);
 	datap = inpkt->u.data;
 	while (items-- > 0) {
 		ZERO(cp);