diff options
| author | GeLiXin <[email protected]> | 2016-08-22 11:20:22 +0800 |
|---|---|---|
| committer | Brian Behlendorf <[email protected]> | 2016-08-22 10:23:47 -0700 |
| commit | 23827a4ca1fbbc95d58398a2ff65dc73e4605ab8 (patch) | |
| tree | 8a7739079661f9de705784eddb3ef9ee6d141c04 /lib/libzfs/libzfs_util.c | |
| parent | 9cc1844a1dab9cb62743f1f31eca73fcc6aaf0c4 (diff) | |
Fix: Array bounds read in zprop_print_one_property()
If the loop index i comes to (ZFS_GET_NCOLS - 1), the cbp->cb_columns[i + 1]
actually read the data of cbp->cb_colwidths[0], which means the array
subscript is above array bounds.
Luckily the cbp->cb_colwidths[0] is always 0 and it seems we haven't
looped enough times to exceed the array bounds so far, but it's really
a secluded risk someday.
Signed-off-by: GeLiXin <[email protected]>
Signed-off-by: Brian Behlendorf <[email protected]>
Closes #5003
Diffstat (limited to 'lib/libzfs/libzfs_util.c')
| -rwxr-xr-x[-rw-r--r--] | lib/libzfs/libzfs_util.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/lib/libzfs/libzfs_util.c b/lib/libzfs/libzfs_util.c index 8fe59a0c0..3c388a3a0 100644..100755 --- a/lib/libzfs/libzfs_util.c +++ b/lib/libzfs/libzfs_util.c @@ -1433,7 +1433,8 @@ zprop_print_one_property(const char *name, zprop_get_cbdata_t *cbp, continue; } - if (cbp->cb_columns[i + 1] == GET_COL_NONE) + if (i == (ZFS_GET_NCOLS - 1) || + cbp->cb_columns[i + 1] == GET_COL_NONE) (void) printf("%s", str); else if (cbp->cb_scripted) (void) printf("%s\t", str); |