Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

6lowpan: iphc: Fix an off-by-one check of array index

The bounds check of id is off-by-one and the comparison should
be >= rather >. Currently the WARN_ON_ONCE check does not stop
the out of range indexing of &ldev->ctx.table[id] so also add
a return path if the bounds are out of range.

Addresses-Coverity: ("Illegal address computation").
Fixes: 5609c185f24d ("6lowpan: iphc: add support for stateful compression")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

authored by

Colin Ian King and committed by
Marcel Holtmann
9af41761 37356827

+2 -1
+2 -1
net/6lowpan/debugfs.c
··· 170 170 struct dentry *root; 171 171 char buf[32]; 172 172 173 - WARN_ON_ONCE(id > LOWPAN_IPHC_CTX_TABLE_SIZE); 173 + if (WARN_ON_ONCE(id >= LOWPAN_IPHC_CTX_TABLE_SIZE)) 174 + return; 174 175 175 176 sprintf(buf, "%d", id); 176 177