[Devel] [ openser-Bugs-1715914 ] segfault on do_load_gws

[SourceForge.net]

Bugs item #1715914, was opened at 2007-05-09 18:59
Message generated for change (Comment added) made by sackrtp
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=743020&aid=1715914&group_id=139143

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: modules
Group: ver 1.2.x
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Angel Carpintero (sackrtp)
Assigned to: Nobody/Anonymous (nobody)
Summary: segfault on do_load_gws

Initial Comment:
Running openser 1.2.x latest svn version i got :

Program terminated with signal 11, Segmentation fault.
#0  do_load_gws (_m=<value optimized out>, grp_id=-1) at lcr_mod.c:1186
1186        prefix_len = (*lcrs)[matched_gws[0].route_index].prefix_len;

matched_gws[0].route_index has a overflow value :

p matched_gws[0].route_index
$1 = 4294967295

That is because previously :

( note gw_index is 0 , line 1173 )

matched_gws[gw_index].route_index = -1;

And route_index is defined as usingned int :

struct mi {
    unsigned int gw_index;
    unsigned int route_index;
    int randomizer;
};

So a simple fix is change unsigned int by int.



----------------------------------------------------------------------

>Comment By: Angel Carpintero (sackrtp)
Date: 2007-05-09 19:25

Message:
Logged In: YES 
user_id=822905
Originator: YES

Also notice about line lcr_mod.c:1219 

index = matched_gws[i].gw_index;
        if (index == -1) {
            break;
        }

If gw_index is define as unsigned int , i can never has a negative value ,
so that comparation is useless.


----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=743020&aid=1715914&group_id=139143