From 2f3379d6c87797c51bbc2835de5bf317db959fd7 Mon Sep 17 00:00:00 2001 From: Rob Davies Date: Thu, 5 Sep 2024 16:21:21 +0100 Subject: [PATCH] Fix out-of-bounds read in cram_codec_iter_next() cram_block_compression_hdr::tag_encoding_map[] has CRAM_MAP_HASH elements, so the iterator should not go beyond that. --- cram/cram_external.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cram/cram_external.c b/cram/cram_external.c index c6d7d66af..4943750dd 100644 --- a/cram/cram_external.c +++ b/cram/cram_external.c @@ -291,7 +291,7 @@ static cram_codec *cram_codec_iter_next(cram_codec_iter *iter, iter->curr_map = iter->curr_map->next; return cc; } - } while (iter->idx <= CRAM_MAP_HASH); + } while (iter->idx < CRAM_MAP_HASH); // End of codecs return NULL;