From mboxrd@z Thu Jan  1 00:00:00 1970
From: Olaf Hering <olaf@aepfle.de>
Subject: [PATCH 07 of 18] tools/blktap2: fix out of bounds
 access in block-log.c
Date: Mon, 02 Apr 2012 22:15:30 +0200
Message-ID: <acb561c6d4d8ebee95ad.1333397730@probook.site>
References: <patchbomb.1333397723@probook.site>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <xen-devel-bounces@lists.xen.org>
In-Reply-To: <patchbomb.1333397723@probook.site>
List-Unsubscribe: <http://lists.xen.org/cgi-bin/mailman/options/xen-devel>,
	<mailto:xen-devel-request@lists.xen.org?subject=unsubscribe>
List-Post: <mailto:xen-devel@lists.xen.org>
List-Help: <mailto:xen-devel-request@lists.xen.org?subject=help>
List-Subscribe: <http://lists.xen.org/cgi-bin/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xen.org?subject=subscribe>
Sender: xen-devel-bounces@lists.xen.org
Errors-To: xen-devel-bounces@lists.xen.org
To: xen-devel@lists.xensource.com
Cc: Ian Jackson <Ian.Jackson@eu.citrix.com>
List-Id: xen-devel@lists.xenproject.org

# HG changeset patch
# User Olaf Hering <olaf@aepfle.de>
# Date 1333397537 -7200
# Node ID acb561c6d4d8ebee95ad0e7007f99a2d22dbaa34
# Parent  8d134408ddf233c6fe3a452b9b9f0780f91170e6
tools/blktap2: fix out of bounds access in block-log.c

block-log.c: In function 'ctl_close_sock':
block-log.c:363:23: warning: array subscript is above array bounds [-Warray-bounds]

Adjust loop condition in ctl_close_sock() to fix warning.
Adjust array acccess in ctl_close() to actually access the array member.

Signed-off-by: Olaf Hering <olaf@aepfle.de>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>

diff -r 8d134408ddf2 -r acb561c6d4d8 tools/blktap2/drivers/block-log.c
--- a/tools/blktap2/drivers/block-log.c
+++ b/tools/blktap2/drivers/block-log.c
@@ -324,11 +324,11 @@ static int ctl_open(struct tdlog_state* 
 static int ctl_close(struct tdlog_state* s)
 {
   while (s->connected) {
+    s->connected--;
     tapdisk_server_unregister_event(s->connections[s->connected].id);
     close(s->connections[s->connected].fd);
     s->connections[s->connected].fd = -1;
     s->connections[s->connected].id = 0;
-    s->connected--;
   }
 
   if (s->ctl.fd >= 0) {
@@ -359,7 +359,7 @@ static int ctl_close_sock(struct tdlog_s
 {
   int i;
 
-  for (i = 0; i <= s->connected; i++) {
+  for (i = 0; i < s->connected; i++) {
     if (s->connections[i].fd == fd) {
       tapdisk_server_unregister_event(s->connections[i].id);
       close(s->connections[i].fd);