ul reaches __arraycount(services) before the bound-check happens, causing undefined behaviour.
Details
Details
Diff Detail
Diff Detail
- Repository
- rG FreeBSD src repository
- Lint
Lint Not Applicable - Unit
Tests Not Applicable
Event Timeline
Comment Actions
Please follow the wiki instructions and be sure to upload full context: https://wiki.freebsd.org/Phabricator#Create_a_Revision_via_Web_Interface
usr.sbin/bluetooth/btpand/btpand.c | ||
---|---|---|
146–151 | Better as: for (ul = 0; ul < __arraycount(services); ul++) { if (strcasecmp(optarg, services[ul].name) == 0) break; } if (ul == __arraycount(services)) errx(EXIT_FAILURE, "%s: unknown service", optarg); or similar, IMO, as a standard idiom |