From 23827a4ca1fbbc95d58398a2ff65dc73e4605ab8 Mon Sep 17 00:00:00 2001 From: GeLiXin Date: Mon, 22 Aug 2016 11:20:22 +0800 Subject: [PATCH] Fix: Array bounds read in zprop_print_one_property() If the loop index i comes to (ZFS_GET_NCOLS - 1), the cbp->cb_columns[i + 1] actually read the data of cbp->cb_colwidths[0], which means the array subscript is above array bounds. Luckily the cbp->cb_colwidths[0] is always 0 and it seems we haven't looped enough times to exceed the array bounds so far, but it's really a secluded risk someday. Signed-off-by: GeLiXin Signed-off-by: Brian Behlendorf Closes #5003 --- lib/libzfs/libzfs_util.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) mode change 100644 => 100755 lib/libzfs/libzfs_util.c diff --git a/lib/libzfs/libzfs_util.c b/lib/libzfs/libzfs_util.c old mode 100644 new mode 100755 index 8fe59a0c04ff..3c388a3a0be2 --- a/lib/libzfs/libzfs_util.c +++ b/lib/libzfs/libzfs_util.c @@ -1433,7 +1433,8 @@ zprop_print_one_property(const char *name, zprop_get_cbdata_t *cbp, continue; } - if (cbp->cb_columns[i + 1] == GET_COL_NONE) + if (i == (ZFS_GET_NCOLS - 1) || + cbp->cb_columns[i + 1] == GET_COL_NONE) (void) printf("%s", str); else if (cbp->cb_scripted) (void) printf("%s\t", str);