From: Stephen Hemminger <stephen.hemminger@vyatta.com>
Date: Mon, 30 Jun 2008 17:37:28 +0000 (-0700)
Subject: Fix array out of bounds problem
X-Git-Tag: v2.6.26~5
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f493dc30094d282d6a76ef8f71753a6d48981f1f;p=thirdparty%2Fiproute2.git

Fix array out of bounds problem

The current kernel generates 71 possible header fields, but
MAX_FIELDS in lnstat is only 64. This leads to referencing outside
of the array. To fix, increase size of array and chop off parsing
at MAX_FIELDS - 1.
---

diff --git a/misc/lnstat.c b/misc/lnstat.c
index b56598ab8..b04e6cebf 100644
--- a/misc/lnstat.c
+++ b/misc/lnstat.c
@@ -17,7 +17,7 @@
  */
 
 /* Maximum number of fields that can be displayed */
-#define MAX_FIELDS		64
+#define MAX_FIELDS		128
 
 /* Maximum number of header lines */
 #define HDR_LINES 		10
@@ -121,9 +121,12 @@ static int map_field_params(struct lnstat_file *lnstat_files,
 				if (!fps->params[j].print.width)
 					fps->params[j].print.width =
 							FIELD_WIDTH_DEFAULT;
-				j++;
+				
+				if (++j >= MAX_FIELDS - 1)
+					goto full;
 			}
 		}
+	full:
 		fps->num = j;
 		return 1;
 	}