Fix off-by-one bug in btpand

`ul` reaches `__arraycount(services)` before the bound-check happens, causing undefined behaviour.

Reviewed by:	imp, jrtc27
Fixes:		7718ced0ea ("Add btpand(8) daemon from NetBSD.")
MFC after:	1 week
Differential Revision:	https://reviews.freebsd.org/D45463

This commit is contained in:

Dapeng Gao

2024-06-03 20:30:36 +01:00

committed by

Jessica Clarke

parent 7f1012ff7c

commit fbfdf57d65

1 changed files with 6 additions and 3 deletions

									
										usr.sbin/bluetooth/btpand/btpand.c
									
		+6
		-3
	
												View File
												
				@@ -143,11 +143,14 @@ main(int argc, char *argv[])

						case 's': /* service */

						case 'S': /* service (no SDP) */

							for (ul = 0; strcasecmp(optarg, services[ul].name); ul++) {

								if (ul == __arraycount(services))

									errx(EXIT_FAILURE, "%s: unknown service", optarg);

							for (ul = 0; ul < __arraycount(services); ul++) {

								if (strcasecmp(optarg, services[ul].name) == 0)

									break;

							}

							if (ul == __arraycount(services))

								errx(EXIT_FAILURE, "%s: unknown service", optarg);

							if (ch == 's')

								service_name = services[ul].name;