Code Review
/
vpp.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
review
|
tree
raw
|
inline
| side by side
Integer underflow and out-of-bounds read (VPP-1442)
[vpp.git]
/
src
/
vppinfra
/
string.h
diff --git
a/src/vppinfra/string.h
b/src/vppinfra/string.h
index
8f165df
..
2c794ba
100644
(file)
--- a/
src/vppinfra/string.h
+++ b/
src/vppinfra/string.h
@@
-356,7
+356,7
@@
clib_count_equal_u64 (u64 * data, uword max_count)
#endif
count += 2;
data += 2;
#endif
count += 2;
data += 2;
- while (count
< max_count - 3
&&
+ while (count
+ 3 < max_count
&&
((data[0] ^ first) | (data[1] ^ first) |
(data[2] ^ first) | (data[3] ^ first)) == 0)
{
((data[0] ^ first) | (data[1] ^ first) |
(data[2] ^ first) | (data[3] ^ first)) == 0)
{
@@
-424,7
+424,7
@@
clib_count_equal_u32 (u32 * data, uword max_count)
#endif
count += 2;
data += 2;
#endif
count += 2;
data += 2;
- while (count
< max_count - 3
&&
+ while (count
+ 3 < max_count
&&
((data[0] ^ first) | (data[1] ^ first) |
(data[2] ^ first) | (data[3] ^ first)) == 0)
{
((data[0] ^ first) | (data[1] ^ first) |
(data[2] ^ first) | (data[3] ^ first)) == 0)
{
@@
-492,7
+492,7
@@
clib_count_equal_u16 (u16 * data, uword max_count)
#endif
count += 2;
data += 2;
#endif
count += 2;
data += 2;
- while (count
< max_count - 3
&&
+ while (count
+ 3 < max_count
&&
((data[0] ^ first) | (data[1] ^ first) |
(data[2] ^ first) | (data[3] ^ first)) == 0)
{
((data[0] ^ first) | (data[1] ^ first) |
(data[2] ^ first) | (data[3] ^ first)) == 0)
{
@@
-560,7
+560,7
@@
clib_count_equal_u8 (u8 * data, uword max_count)
#endif
count += 2;
data += 2;
#endif
count += 2;
data += 2;
- while (count
< max_count - 3
&&
+ while (count
+ 3 < max_count
&&
((data[0] ^ first) | (data[1] ^ first) |
(data[2] ^ first) | (data[3] ^ first)) == 0)
{
((data[0] ^ first) | (data[1] ^ first) |
(data[2] ^ first) | (data[3] ^ first)) == 0)
{