From owner-freebsd-hackers@FreeBSD.ORG Sat Aug 21 12:01:28 2004 Return-Path: Delivered-To: freebsd-hackers@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 8BA1016A4CE for ; Sat, 21 Aug 2004 12:01:28 +0000 (GMT) Received: from out009.verizon.net (out009pub.verizon.net [206.46.170.131]) by mx1.FreeBSD.org (Postfix) with ESMTP id 23C8F43D2D for ; Sat, 21 Aug 2004 12:01:28 +0000 (GMT) (envelope-from skip.ford@verizon.net) Received: from pool-70-17-33-17.pskn.east.verizon.net ([70.17.33.17]) by out009.verizon.netESMTP <20040821120127.UFNK23440.out009.verizon.net@pool-70-17-33-17.pskn.east.verizon.net>; Sat, 21 Aug 2004 07:01:27 -0500 Date: Sat, 21 Aug 2004 08:01:26 -0400 From: Skip Ford To: Maxim Konovalov Message-ID: <20040821120126.GA586@lucy.pool-70-17-33-167.pskn.east.verizon.net> References: <412652AA.5020308@coverity.com> <20040821120624.I34489@mp2.macomnet.net> <20040821090001.GB593@lucy.pool-70-17-33-167.pskn.east.verizon.net> <20040821131924.U34847@mp2.macomnet.net> <20040821150427.O35076@mp2.macomnet.net> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20040821150427.O35076@mp2.macomnet.net> User-Agent: Mutt/1.4.2.1i X-Authentication-Info: Submitted using SMTP AUTH at out009.verizon.net from [70.17.33.17] at Sat, 21 Aug 2004 07:01:27 -0500 cc: hackers@freebsd.org cc: Ted Unangst Subject: Re: off by one bounds X-BeenThere: freebsd-hackers@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Technical Discussions relating to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 21 Aug 2004 12:01:28 -0000 Maxim Konovalov wrote: > On Sat, 21 Aug 2004, 13:19+0400, Maxim Konovalov wrote: > > On Sat, 21 Aug 2004, 05:00-0400, Skip Ford wrote: > > > Maxim Konovalov wrote: > > > > On Fri, 20 Aug 2004, 12:36-0700, Ted Unangst wrote: > > > > > > > > > errors in freebsd 4.10 found by Coverity's analysis. > > > > > > > > > ip_icmp.c:ip_next_mtu, i == sizeof, dir >= 0 > > > > > > > > If i == sizeof then mtutab[i] == 0 > > > > > > If "i == sizeof" then mtutab[i] is out of bounds, off by one. > > > There is no mtutab[sizeof mtutab / sizeof mtutab[0]]. > > > > > > This isn't specific to RELENG_4 > > After the second thought I still think it is not a error. mtu is > always >= than the minimal value in mtutab[] that is why i is always > less than (sizeof mtutab) / sizeof mtutab[0]). What do you think? I have no idea if it can actually be triggered. Callers may never invoke it with the necessary parameters but if they do, the function doesn't handle it. If mtu is < 0 and dir >= 0 then mtutab is accessed out of bounds. -- Skip