Date: Sun, 27 Nov 2011 15:45:36 +0000 From: Alexander Best <arundel@freebsd.org> To: freebsd-current@freebsd.org Cc: freebsd-net@freebsd.org Subject: possible array out of bounds access in sys/netinet/sctp_output.c Message-ID: <20111127154536.GA54043@freebsd.org>
next in thread | raw e-mail | index | archive | help
hi there,
i've been playing with clang tot and noticed the following error:
/usr/local/bin/clang -c -O3 -pipe -fno-inline-functions -fno-strict-aliasing -march=core2 -std=c99 -g -fdiagnostics-show-option -fformat-extensions -Wall -Wcast-qual -Winline -Wmissing-include-dirs -Wmissing-prototypes -Wnested-externs -Wpointer-arith -Wredundant-decls -Wstrict-prototypes -Wundef -Wno-pointer-sign -nostdinc -I. -I/usr/git-freebsd-head/sys -I/usr/git-freebsd-head/sys/contrib/altq -D_KERNEL -DHAVE_KERNEL_OPTION_HEADERS -include opt_global.h -fno-omit-frame-pointer -mno-aes -mno-avx -mcmodel=kernel -mno-red-zone -mno-mmx -msoft-float -fno-asynchronous-unwind-tables -ffreestanding -Wno-error=tautological-compare -Wno-error=shift-count-negative -Wno-error=shift-count-overflow -Wno-error=shift-overflow -Wno-error=conversion -Wno-error=empty-body -Wno-error=gnu-designator -Wno-error=format -Wno-error=format-invalid-specifier -Wno-error=format-extra-args -Werror /usr/git-freebsd-head/sys/netinet/sctp_output.c
clang: warning: argument unused during compilation: '-fformat-extensions'
/usr/git-freebsd-head/sys/netinet/sctp_output.c:4685:2: error: array index 1 is past the end of the array (which contains 1 element) [-Werror,-Warray-bounds]
sup_addr->addr_type[1] = htons(SCTP_IPV6_ADDRESS);
^ ~
/usr/git-freebsd-head/sys/netinet/sctp_header.h:84:2: note: array 'addr_type' declared here
uint16_t addr_type[SCTP_ARRAY_MIN_LEN]; /* array of supported address
^
1 error generated.
*** Error code 1
Stop in /usr/obj/usr/git-freebsd-head/sys/GENERIC.
*** Error code 1
Stop in /usr/git-freebsd-head.
*** Error code 1
Stop in /usr/git-freebsd-head.
this is from a GENERIC kernel build (so INET + INET6) for amd64. is this a
false positive, or is length(sup_addr->addr_type) really == 1, thus making
sup_addr->addr_type[1] an illegal access?
cheers.
alex
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20111127154536.GA54043>