From: GeLiXin <ge.lixin@zte.com.cn>
Date: Mon, 22 Aug 2016 03:20:22 +0000 (+0800)
Subject: Fix: Array bounds read in zprop_print_one_property()
X-Git-Tag: zfs-0.7.0-rc1~21
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=23827a4ca1fbbc95d58398a2ff65dc73e4605ab8;p=zfs

Fix: Array bounds read in zprop_print_one_property()

If the loop index i comes to (ZFS_GET_NCOLS - 1), the cbp->cb_columns[i + 1]
actually read the data of cbp->cb_colwidths[0], which means the array
subscript is above array bounds.

Luckily the cbp->cb_colwidths[0] is always 0 and it seems we haven't
looped enough times to exceed the array bounds so far, but it's really
a secluded risk someday.

Signed-off-by: GeLiXin <ge.lixin@zte.com.cn>
Signed-off-by: Brian Behlendorf <behlendorf1@llnl.gov>
Closes #5003
---

diff --git a/lib/libzfs/libzfs_util.c b/lib/libzfs/libzfs_util.c
old mode 100644
new mode 100755
index 8fe59a0c0..3c388a3a0
--- a/lib/libzfs/libzfs_util.c
+++ b/lib/libzfs/libzfs_util.c
@@ -1433,7 +1433,8 @@ zprop_print_one_property(const char *name, zprop_get_cbdata_t *cbp,
 			continue;
 		}
 
-		if (cbp->cb_columns[i + 1] == GET_COL_NONE)
+		if (i == (ZFS_GET_NCOLS - 1) ||
+		    cbp->cb_columns[i + 1] == GET_COL_NONE)
 			(void) printf("%s", str);
 		else if (cbp->cb_scripted)
 			(void) printf("%s\t", str);