Commit bd1acd5
committed
Fix memory corruption in mkstr caused by integer overflow
The static 'slot' variable in mkstr() was previously a signed 32-bit
integer. On high-load systems (e.g., during status data dumps), this
counter could overflow, becoming negative.
In C, a negative dividend with the modulo operator (slot % 256) results
in a negative index. This caused the 'ret' pointer to point to memory
addresses BEFORE the actual buffer. In our case, this led to a SIGSEGV
because a timestamp string was written directly over the 'contact_list'
pointer, which happened to be located in that memory region.
Changes:
- Changed 'slot' from signed int to unsigned int (uint) to ensure
the modulo result is always positive and within buffer bounds.
- This ensures that upon reaching UINT_MAX, the counter wraps
safely back to zero.
Signed-off-by: nook24 <d.ziegler@avendis.com>1 parent 35489d1 commit bd1acd5
1 file changed
+1
-1
lines changed| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
89 | 89 | | |
90 | 90 | | |
91 | 91 | | |
92 | | - | |
| 92 | + | |
93 | 93 | | |
94 | 94 | | |
95 | 95 | | |
| |||
0 commit comments