|
Description
|
usr/src/cmd/rmformat/rmf_slice.c
0653: vt->v_part[index].p_start = val1;
0654: vt->v_part[index].p_size = val2;
0655: if (vtoc_tag != 0xFFFF) {
0656: vt->v_part[index].p_tag = vtoc_tag;
0657: vtoc_tag = 0xFFFF;
0658: }
0659: if (vtoc_flag != 0xFFFF) {
0660: vt->v_part[index].p_flag = vtoc_flag;
0661: vtoc_flag = 0xFFFF;
0662: }
index has an off-by-one guard on line 467 that allows index to range from
0..NDKMAP (16) inclusive, allowing writes past the end of v_part.
This bug was found using the Parfait source code analysis tool.
See http://research.sun.com/projects/parfait
|
