lua: fix possible out-of-bounds read in iwinfo_L_cryptotable()

[project/iwinfo.git] / iwinfo_lua.c

diff --git a/iwinfo_lua.c b/iwinfo_lua.c
index 21d6bbc..2154ecc 100644 (file)
--- a/iwinfo_lua.c
+++ b/iwinfo_lua.c
@@ -190,7 +190,7 @@ static void iwinfo_L_cryptotable(lua_State *L, struct iwinfo_crypto_entry *c)
        lua_setfield(L, -2, "wpa");
 
        lua_newtable(L);
        lua_setfield(L, -2, "wpa");
 
        lua_newtable(L);

-       for (i = 0, j = 1; i < 8; i++)
+       for (i = 0, j = 1; i < ARRAY_SIZE(IWINFO_CIPHER_NAMES); i++)

        {
                if (c->pair_ciphers & (1 << i))
                {
        {
                if (c->pair_ciphers & (1 << i))
                {


@@ -201,7 +201,7 @@ static void iwinfo_L_cryptotable(lua_State *L, struct iwinfo_crypto_entry *c)
        lua_setfield(L, -2, "pair_ciphers");
 
        lua_newtable(L);
        lua_setfield(L, -2, "pair_ciphers");
 
        lua_newtable(L);

-       for (i = 0, j = 1; i < 8; i++)
+       for (i = 0, j = 1; i < ARRAY_SIZE(IWINFO_CIPHER_NAMES); i++)

        {
                if (c->group_ciphers & (1 << i))
                {
        {
                if (c->group_ciphers & (1 << i))
                {


@@ -212,7 +212,7 @@ static void iwinfo_L_cryptotable(lua_State *L, struct iwinfo_crypto_entry *c)
        lua_setfield(L, -2, "group_ciphers");
 
        lua_newtable(L);
        lua_setfield(L, -2, "group_ciphers");
 
        lua_newtable(L);

-       for (i = 0, j = 1; i < 8; i++)
+       for (i = 0, j = 1; i < ARRAY_SIZE(IWINFO_KMGMT_NAMES); i++)

        {
                if (c->auth_suites & (1 << i))
                {
        {
                if (c->auth_suites & (1 << i))
                {


@@ -223,7 +223,7 @@ static void iwinfo_L_cryptotable(lua_State *L, struct iwinfo_crypto_entry *c)
        lua_setfield(L, -2, "auth_suites");
 
        lua_newtable(L);
        lua_setfield(L, -2, "auth_suites");
 
        lua_newtable(L);

-       for (i = 0, j = 1; i < 8; i++)
+       for (i = 0, j = 1; i < ARRAY_SIZE(IWINFO_AUTH_NAMES); i++)

        {
                if (c->auth_algs & (1 << i))
                {
        {
                if (c->auth_algs & (1 << i))
                {


@@ -597,7 +597,7 @@ static char * iwinfo_L_country_lookup(char *buf, int len, int iso3166)
 
 static int iwinfo_L_countrylist(lua_State *L, int (*func)(const char *, char *, int *))
 {
 
 static int iwinfo_L_countrylist(lua_State *L, int (*func)(const char *, char *, int *))
 {

-       int len, i, j;
+       int len, i;

        char rv[IWINFO_BUFSIZE], alpha2[3];
        char *ccode;
        const char *ifname = luaL_checkstring(L, 1);
        char rv[IWINFO_BUFSIZE], alpha2[3];
        char *ccode;
        const char *ifname = luaL_checkstring(L, 1);


@@ -608,7 +608,7 @@ static int iwinfo_L_countrylist(lua_State *L, int (*func)(const char *, char *,
 
        if (!(*func)(ifname, rv, &len))
        {
 
        if (!(*func)(ifname, rv, &len))
        {

-               for (l = IWINFO_ISO3166_NAMES, j = 1; l->iso3166; l++)
+               for (l = IWINFO_ISO3166_NAMES, i = 1; l->iso3166; l++)

                {
                        if ((ccode = iwinfo_L_country_lookup(rv, len, l->iso3166)) != NULL)
                        {
                {
                        if ((ccode = iwinfo_L_country_lookup(rv, len, l->iso3166)) != NULL)
                        {


@@ -626,7 +626,7 @@ static int iwinfo_L_countrylist(lua_State *L, int (*func)(const char *, char *,
                                lua_pushstring(L, l->name);
                                lua_setfield(L, -2, "name");
 
                                lua_pushstring(L, l->name);
                                lua_setfield(L, -2, "name");
 

-                               lua_rawseti(L, -2, j++);
+                               lua_rawseti(L, -2, i++);

                        }
                }
        }
                        }
                }
        }