Fix incorrect bounds check for sector count. (Francisco Alonso and Jan Kaluza

at RedHat)

diff --git a/src/cdf.c b/src/cdf.c
index 375406c3789e8154b5eec38efd3c3ad7492ed342..6652581c27b843379a3e47b5223be9e7c9485445 100644 (file)
--- a/src/cdf.c
+++ b/src/cdf.c
@@ -35,7 +35,7 @@
 #include "file.h"
 
 #ifndef lint
-FILE_RCSID("@(#)$File: cdf.c,v 1.59 2014/05/14 23:22:48 christos Exp $")
+FILE_RCSID("@(#)$File: cdf.c,v 1.60 2014/05/21 13:04:38 christos Exp $")
 #endif
 
 #include <assert.h>
@@ -455,7 +455,8 @@ size_t
 cdf_count_chain(const cdf_sat_t *sat, cdf_secid_t sid, size_t size)
 {
        size_t i, j;
-       cdf_secid_t maxsector = (cdf_secid_t)(sat->sat_len * size);
+       cdf_secid_t maxsector = (cdf_secid_t)((sat->sat_len * size)
+           / sizeof(maxsector));
 
        DPRINTF(("Chain:"));
        for (j = i = 0; sid >= 0; i++, j++) {
@@ -465,8 +466,8 @@ cdf_count_chain(const cdf_sat_t *sat, cdf_secid_t sid, size_t size)
                        errno = EFTYPE;
                        return (size_t)-1;
                }
-               if (sid > maxsector) {
-                       DPRINTF(("Sector %d > %d\n", sid, maxsector));
+               if (sid >= maxsector) {
+                       DPRINTF(("Sector %d >= %d\n", sid, maxsector));
                        errno = EFTYPE;
                        return (size_t)-1;
                }