Author: Henrik Nordstrom <hno@squid-cache.org>

Fix bug 2010. Buffer overread at a loop termination.

Boolean logic typo caused an endcase read of an array-counting loop
to over-read the array in its termination condition.
Became visible with additional g++-4.2 code-safety checks.

diff --git a/src/snmp_core.cc b/src/snmp_core.cc
index 65387fd93c02fd1433c6cefb4852835c5000eb99..2e006caccaccfff0d226ff66ea869376bd30b934 100644 (file)
--- a/src/snmp_core.cc
+++ b/src/snmp_core.cc
@@ -1,6 +1,6 @@
 
 /*
- * $Id: snmp_core.cc,v 1.78 2007/04/30 16:56:09 wessels Exp $
+ * $Id: snmp_core.cc,v 1.79 2007/07/06 11:30:45 amosjeffries Exp $
  *
  * DEBUG: section 49    SNMP support
  * AUTHOR: Glenn Chisholm
@@ -825,7 +825,7 @@ time_Inst(oid * name, snint * len, mib_tree_entry * current, oid_ParseFn ** Fn)
     } else {
         identifier = name[*len - 1];
 
-        while ((identifier != index[loop]) && (loop < TIME_INDEX_LEN))
+        while ((loop < TIME_INDEX_LEN) && (identifier != index[loop]))
             loop++;
 
         if (loop < TIME_INDEX_LEN - 1) {