From: Willy Tarreau <w@1wt.eu>
Date: Wed, 11 Dec 2019 14:51:37 +0000 (+0100)
Subject: BUG/MINOR: listener: fix off-by-one in state name check
X-Git-Tag: v2.2-dev1~184
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=fec56c6a76463d40be3e15eee297aa8d2b67362a;p=thirdparty%2Fhaproxy.git

BUG/MINOR: listener: fix off-by-one in state name check

As reported in issue #380, the state check in listener_state_str() is
invalid as it allows state value 9 to report crap. We don't use such
a state value so the issue should never happen unless the memory is
already corrupted, but better clean this now while it's harmless.

This should be backported to all maintained branches.
---

diff --git a/include/proto/listener.h b/include/proto/listener.h
index e8f9ece5f4..ca7dc9c7cf 100644
--- a/include/proto/listener.h
+++ b/include/proto/listener.h
@@ -176,7 +176,7 @@ static inline const char *listener_state_str(const struct listener *l)
 	};
 	unsigned int st = l->state;
 
-	if (st > sizeof(states) / sizeof(*states))
+	if (st >= sizeof(states) / sizeof(*states))
 		return "INVALID";
 	return states[st];
 }