mpx_wrappers.c (move_bounds): Fix overflow bug.

libmpx/

2016-06-10  Ilya Enkovich  <ilya.enkovich@intel.com>

	* mpxwrap/mpx_wrappers.c (move_bounds): Fix overflow bug.

From-SVN: r237292

diff --git a/libmpx/ChangeLog b/libmpx/ChangeLog
index 4d5858122dc695f8838a6fdcd1de5949c9fc85b7..636e965136479938f94225b4a66f9c2705c115ea 100644 (file)
--- a/libmpx/ChangeLog
+++ b/libmpx/ChangeLog
@@ -1,3 +1,7 @@
+2016-06-10  Ilya Enkovich  <ilya.enkovich@intel.com>
+
+       * mpxwrap/mpx_wrappers.c (move_bounds): Fix overflow bug.
+
 2016-01-20  Matthias Klose  <doko@ubuntu.com>
 
         * libtool-version: Remove.

diff --git a/libmpx/mpxwrap/mpx_wrappers.c b/libmpx/mpxwrap/mpx_wrappers.c
index d4c83ef484cac63e4800181c05c75cf22b9377d8..171a780311d3295b418525c60307457a7472190d 100644 (file)
--- a/libmpx/mpxwrap/mpx_wrappers.c
+++ b/libmpx/mpxwrap/mpx_wrappers.c
@@ -27,6 +27,7 @@
 #include "string.h"
 #include <sys/mman.h>
 #include <stdint.h>
+#include <assert.h>
 #include "mpxrt/mpxrt.h"
 
 void *
@@ -418,7 +419,16 @@ move_bounds (void *dst, const void *src, size_t n)
           else
             elems_to_copy -= src_bt_index_end + 1;
         }
-      src_bd_index_end--;
+      /* Go to previous table but beware of overflow.
+        We should have copied all required element
+        in case src_bd_index_end is 0.  */
+      if (src_bd_index_end)
+       src_bd_index_end--;
+      else
+       {
+         assert (!elems_to_copy);
+         return;
+       }
       /* For each bounds table we check if there are valid pointers inside.
          If there are some, we copy table in pre-counted portions.  */
       for (; src_bd_index_end > src_bd_index; src_bd_index_end--)