[PATCH iproute2 1/1] color: Fix ip segfault in color_fprintf() when using --color switch

[PATCH iproute2 1/1] color: Fix ip segfault in color_fprintf() when using --color switch

[Petr Vorel]

This fixes two regressions:

Commit 959f1428 ("color: add new COLOR_NONE and disable_color function")
caused segfault, when running ip with --color switch, as 'attr + 8' in
color_fprintf() access array item out of bounds.
Changing latter value of ternar operator in attr_colors[] index is for
restoring the same colors.
Reproduce the bug with:
$ ip -c a

Commit d0e72011 ("ip: ipaddress.c: add support for json output")
introduced passing -1 as enum color_attr. This is not only wrong as no
color_attr has value -1, but also causes another segfault in color_fprintf()
on this setup as there is no item with index -1 in array of enum attr_colors[].
Using 0 is valid option.

Reproduce the bug with:
$ COLORFGBG='0;15' ip -c a

NOTE: COLORFGBG is environmental variable used for defining whether user
has light or dark background.
COLORFGBG="0;15" is used to ask for color set suitable for light background,
COLORFGBG="15;0" is used to ask for color set suitable for dark background.

Signed-off-by: Petr Vorel <petr.vorel@gmail.com>
---
 include/json_print.h | 2 +-
 lib/color.c          | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/json_print.h b/include/json_print.h
index b6ce1f9f..2f3f07c8 100644
--- a/include/json_print.h
+++ b/include/json_print.h
@@ -53,7 +53,7 @@ void close_json_array(enum output_type type, const char *delim);
 					     const char *fmt,		\
 					     type value)		\
 	{								\
-		print_color_##type_name(t, -1, key, fmt, value);	\
+		print_color_##type_name(t, 0, key, fmt, value);	\
 	}
 _PRINT_FUNC(int, int);
 _PRINT_FUNC(bool, bool);
diff --git a/lib/color.c b/lib/color.c
index 79d5e289..e597798f 100644
--- a/lib/color.c
+++ b/lib/color.c
@@ -110,7 +110,7 @@ int color_fprintf(FILE *fp, enum color_attr attr, const char *fmt, ...)
 	}
 
 	ret += fprintf(fp, "%s",
-		       color_codes[attr_colors[is_dark_bg ? attr + 8 : attr]]);
+		       color_codes[attr_colors[is_dark_bg ? attr + 6 : attr - 1]]);
 	ret += vfprintf(fp, fmt, args);
 	ret += fprintf(fp, "%s", color_codes[C_CLEAR]);
 
-- 
2.14.2

Re: [PATCH iproute2 1/1] color: Fix ip segfault in color_fprintf() when using --color switch

[Stephen Hemminger]

On Sun,  8 Oct 2017 16:38:47 +0200
Petr Vorel <petr.vorel@gmail.com> wrote:

> diff --git a/include/json_print.h b/include/json_print.h
> index b6ce1f9f..2f3f07c8 100644
> --- a/include/json_print.h
> +++ b/include/json_print.h
> @@ -53,7 +53,7 @@ void close_json_array(enum output_type type, const char *delim);
>  					     const char *fmt,		\
>  					     type value)		\
>  	{								\
> -		print_color_##type_name(t, -1, key, fmt, value);	\
> +		print_color_##type_name(t, 0, key, fmt, value);	\
>  	}
>  _PRINT_FUNC(int, int);
>  _PRINT_FUNC(bool, bool);
> diff --git a/lib/color.c b/lib/color.c
> index 79d5e289..e597798f 100644
> --- a/lib/color.c
> +++ b/lib/color.c
> @@ -110,7 +110,7 @@ int color_fprintf(FILE *fp, enum color_attr attr, const char *fmt, ...)
>  	}
>  
>  	ret += fprintf(fp, "%s",
> -		       color_codes[attr_colors[is_dark_bg ? attr + 8 : attr]]);
> +		       color_codes[attr_colors[is_dark_bg ? attr + 6 : attr - 1]]);

Magic offsets (8 and -1) are error prone. Can this be changed to an enum value from colors?