Description: prevent out-of-bounds
Author: Jörg Frings-Fürst <debian@jff-webhosting.net>
Forwarded: https://sourceforge.net/p/ipmiutil/mailman/ipmiutil-developers/?viewmonth=201410
Last-Update: 2014-10-29
---
Index: trunk/util/ievents.c
===================================================================
--- trunk.orig/util/ievents.c
+++ trunk/util/ievents.c
@@ -193,10 +193,10 @@ static const char *sensor_types[NSTYPES]
 /* 2Eh */ "ME"    /* 0xDC == ME Node Manager */
 };
 
-#define NFWERRS  15
+#define NFWERRS  14
 static struct {    /* See Table 36-3, type 0Fh, offset 00h */
   int code; char *msg; 
-  } fwerrs[NFWERRS] = {
+  } fwerrs[NFWERRS + 1] = {
  { 0x00, "Unspecified"},
  { 0x01, "No system memory"},
  { 0x02, "No usable memory"},
@@ -214,10 +214,10 @@ static struct {    /* See Table 36-3, ty
  { 0x0E, "Reserved" }
 };
 
-#define NFWSTAT  27
+#define NFWSTAT  26
 static struct {    /* See Table 36-3, type 0Fh, offset 01h & 02h */
   int code; char *msg; 
-  } fwstat[NFWSTAT] = {
+  } fwstat[NFWSTAT + 1] = {
  { 0x00, "Unspecified"},
  { 0x01, "Memory init"},
  { 0x02, "Hard disk init"},
Index: trunk/util/ifirewall.h
===================================================================
--- trunk.orig/util/ifirewall.h
+++ trunk/util/ifirewall.h
@@ -82,7 +82,7 @@ struct lun_netfn_support {
 };
 struct lun_support {
 	unsigned char support;
-	struct lun_netfn_support netfn[MAX_NETFN_PAIR];
+	struct lun_netfn_support netfn[MAX_NETFN];
 };
 struct bmc_fn_support {
 	struct lun_support lun[MAX_LUN];
Index: trunk/util/iconfig.c
===================================================================
--- trunk.orig/util/iconfig.c
+++ trunk/util/iconfig.c
@@ -1765,7 +1765,7 @@ int SerialIsOptional(int bparam)
    int optvals[9] = { 5, 9, 10, 11, 12, 13, 14, 20, 21 };
    int rv = 0;
    int i;
-   for (i = 0; i < sizeof(optvals); i++) {
+   for (i = 0; i < (sizeof(optvals) / sizeof(int)); i++) {
       if (optvals[i] == bparam) { rv = 1; break; }
    }
    return(rv);