From 521e96ca751df072e5c71d3844ed5708b79ac69d Mon Sep 17 00:00:00 2001 From: Rusty Russell Date: Mon, 6 Dec 2010 13:35:50 +1030 Subject: idtree: fix overflow for v. large ids on allocation and removal Chris Cowan tracked down a SEGV in sub_alloc: idp->level can actually be equal to 7 (MAX_LEVEL) there, as it can be in sub_remove. (We unfairly blamed a shift of a signed var for this crash in commit 2db1987f5a3a). Signed-off-by: Rusty Russell Autobuild-User: Rusty Russell Autobuild-Date: Mon Dec 6 05:02:22 CET 2010 on sn-devel-104 --- lib/util/idtree.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'lib') diff --git a/lib/util/idtree.c b/lib/util/idtree.c index 6611992a25..3648761069 100644 --- a/lib/util/idtree.c +++ b/lib/util/idtree.c @@ -104,7 +104,7 @@ static int sub_alloc(struct idr_context *idp, void *ptr, int *starting_id) { int n, m, sh; struct idr_layer *p, *pn; - struct idr_layer *pa[MAX_LEVEL]; + struct idr_layer *pa[MAX_LEVEL+1]; unsigned int l, id, oid; uint32_t bm; -- cgit