[libnl-nft PATCH] Fix out of bounds buffer access in rtnl_netem_set_delay_distribution()

[Thomas Jarosch <thomas.jarosch@intra2net.com>]

sizeof(test_path) returns the array size
and not the number of array elements.

Detected by cppcheck

Signed-off-by: Thomas Jarosch <thomas.jarosch@intra2net.com>
---
 lib/route/sch/netem.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/lib/route/sch/netem.c b/lib/route/sch/netem.c
index 18878a7..5894fd9 100644
--- a/lib/route/sch/netem.c
+++ b/lib/route/sch/netem.c
@@ -861,7 +861,7 @@ int rtnl_netem_set_delay_distribution(struct rtnl_qdisc *qdisc, const char *dist
 		return -NLE_NOMEM;
 		
 	FILE *f = NULL;
-	int i, n = 0;
+	int i = 0, n = 0;
 	size_t len = 2048;
 	char *line;
 	char name[NAME_MAX];
@@ -873,11 +873,12 @@ int rtnl_netem_set_delay_distribution(struct rtnl_qdisc *qdisc, const char *dist
 		strcpy(dist_suffix, "");
 	
 	/* Check several locations for the dist file */
-	char *test_path[] = { "", "./", "/usr/lib/tc/", "/usr/local/lib/tc/" };
+	char *test_path[] = { "", "./", "/usr/lib/tc/", "/usr/local/lib/tc/", NULL };
 	
-	for (i = 0; i < sizeof(test_path) && f == NULL; i++) {
+	while(f == NULL && test_path[i] != NULL) {
 		snprintf(name, NAME_MAX, "%s%s%s", test_path[i], dist_type, dist_suffix);
 		f = fopen(name, "r");
+		++i;
 	}
 	
 	if ( f == NULL )
-- 
1.7.11.7