upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-06-10 17:22:46 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix off-by-one bug in btpand

Browse source 
`ul` reaches `__arraycount(services)` before the bound-check happens, causing undefined behaviour.

Reviewed by:	imp, jrtc27
Fixes:		7718ced0ea ("Add btpand(8) daemon from NetBSD.")
MFC after:	1 week
Differential Revision:	https://reviews.freebsd.org/D45463
This commit is contained in:
Dapeng Gao 2024-06-03 20:30:36 +01:00 committed by Jessica Clarke
parent 7f1012ff7c
commit fbfdf57d65
1 changed files with 6 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
usr.sbin/bluetooth/btpand/btpand.c
View file

@ -143,11 +143,14 @@ main(int argc, char *argv[])
case 's': /* service */
case 'S': /* service (no SDP) */
for (ul = 0; strcasecmp(optarg, services[ul].name); ul++) {
if (ul == __arraycount(services))
errx(EXIT_FAILURE, "%s: unknown service", optarg);
for (ul = 0; ul < __arraycount(services); ul++) {
if (strcasecmp(optarg, services[ul].name) == 0)
break;
}
if (ul == __arraycount(services))
errx(EXIT_FAILURE, "%s: unknown service", optarg);
if (ch == 's')
service_name = services[ul].name;