[bugzilla-daemon@xxxxxxxxxxxxx]

Peter Wu changed bug 9579

What	Removed	Added
Status	UNCONFIRMED	CONFIRMED
CC		lekensteyn@gmail.com
Ever confirmed		1

Comment # 5 on bug 9579 from Peter Wu

For some reason, ch has become choice + 3 which is past the choice array:
(gdb) p ch
$14 = (const ber_choice_t *) 0x7ffff34c5db8
(gdb) p choice
$15 = (const ber_choice_t *) 0x7ffff34c5d40 <RegisterResponse_choice>
(gdb) p choice + 1
$16 = (const ber_choice_t *) 0x7ffff34c5d68 <RegisterResponse_choice+40>
(gdb) p choice + 2
$17 = (const ber_choice_t *) 0x7ffff34c5d90 <RegisterResponse_choice+80>
(gdb) p choice + 3
$18 = (const ber_choice_t *) 0x7ffff34c5db8



// choice is an array of size 3 with the last element being empty
ch = choice;
while (ch->func || first_pass) {
    // ...
choice_try_again:
    // ...
    if ((count == 0) && (((ch->ber_class == ber_class) && (ch->tag == -1) &&
(ch->flags & BER_FLAGS_NOOWNTAG)) || !first_pass)) {
        ch++;   // (1)
        goto choice_try_again;  // <-- oops
    }
    // ...
    ch++;
}

&choice[1] is the last non-empty element. If (1) gets executed twice, then ch =
&choice[3] which is past the buffer. That piece of code really needs closer
attention (ifdef REMOVED?!), but I am unfamiliar with BER and do not know the
correct way to fix this (throw exception? break unconditionally? break if
!first_pass?).

---

      You are receiving this mail because:

• You are watching all bug changes.