From 2b542020898873e0a67b4ec506546773f5cfd43c Mon Sep 17 00:00:00 2001 From: Matthias Schiffer Date: Sun, 24 May 2020 01:13:05 +0200 Subject: [PATCH] platform: fix crash in binary search for _link_type_from_rtnl_type(), _link_type_from_devtype() When searching an element that is lower than the first list element (for example RTNL type "batadv"), imax will be -1 after the last iteration. Use int instead of unsigned to make the termination condition imin > imax work in this case. This fixes NetworkManager crashing due to an out-of-bounds array access whenever interfaces of such types exist. Fixes: 19ad044359c4 ('platform: use binary search to lookup NMLinkType for rtnl_type') https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/515 --- src/platform/nm-linux-platform.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/src/platform/nm-linux-platform.c b/src/platform/nm-linux-platform.c index 014cca71da..13eb1e3e34 100644 --- a/src/platform/nm-linux-platform.c +++ b/src/platform/nm-linux-platform.c @@ -726,9 +726,9 @@ _link_type_from_rtnl_type (const char *name) \ } { - unsigned imin = 0; - unsigned imax = (G_N_ELEMENTS (LIST) - 1); - unsigned imid = (G_N_ELEMENTS (LIST) - 1) / 2; + int imin = 0; + int imax = (G_N_ELEMENTS (LIST) - 1); + int imid = (G_N_ELEMENTS (LIST) - 1) / 2; for (;;) { const int cmp = strcmp (link_descs[LIST[imid]].rtnl_type, name); @@ -787,9 +787,9 @@ _link_type_from_devtype (const char *name) \ } { - unsigned imin = 0; - unsigned imax = (G_N_ELEMENTS (LIST) - 1); - unsigned imid = (G_N_ELEMENTS (LIST) - 1) / 2; + int imin = 0; + int imax = (G_N_ELEMENTS (LIST) - 1); + int imid = (G_N_ELEMENTS (LIST) - 1) / 2; for (;;) { const int cmp = strcmp (link_descs[LIST[imid]].devtype, name);