Fix two bugs found by Coverity scan.

One was a simple buffer overrun; the other was a high-speed pointer
collision.  Both were introduced by my microdescs branch.

diff --git a/src/common/container.c b/src/common/container.c
index 4fb94d3f7cbe42b99543e84bf0ad63ceed1b3e94..f3540f74d8c6e5992b901b5e064ebbbe940c11d7 100644 (file)
--- a/src/common/container.c
+++ b/src/common/container.c
@@ -470,26 +470,26 @@ smartlist_get_most_frequent(const smartlist_t *sl,
   const void *most_frequent = NULL;
   int most_frequent_count = 0;
 
-  const void **cur = NULL;
+  const void *cur = NULL;
   int i, count=0;
 
   if (!sl->num_used)
     return NULL;
   for (i = 0; i < sl->num_used; ++i) {
     const void *item = sl->list[i];
-    if (cur && 0 == compare(cur, &item)) {
+    if (cur && 0 == compare(&cur, &item)) {
       ++count;
     } else {
       if (cur && count >= most_frequent_count) {
-        most_frequent = *cur;
+        most_frequent = cur;
         most_frequent_count = count;
       }
-      cur = &item;
+      cur = item;
       count = 1;
     }
   }
   if (cur && count >= most_frequent_count) {
-    most_frequent = *cur;
+    most_frequent = cur;
     most_frequent_count = count;
   }
   return (void*)most_frequent;

diff --git a/src/or/dirvote.c b/src/or/dirvote.c
index ca81b2be9de6de88222b8fe5c9777381eb046261..5ce3fd2ca7bdd2bc067f3c9e69659317319a0424 100644 (file)
--- a/src/or/dirvote.c
+++ b/src/or/dirvote.c
@@ -2794,7 +2794,7 @@ ssize_t
 dirvote_format_microdesc_vote_line(char *out, size_t out_len,
                                    const microdesc_t *md)
 {
-  char d64[BASE64_DIGEST256_LEN];
+  char d64[BASE64_DIGEST256_LEN+1];
   if (!microdesc_consensus_methods) {
     microdesc_consensus_methods =
       make_consensus_method_list(MIN_METHOD_FOR_MICRODESC,