Petr Pisar wrote, at 01/08/2013 12:50 AM +9:00:
On 2013-01-04, Jakub Jelinek <jakub(a)redhat.com> wrote:
> yap-6.2.2-4.fc18.src.rpm
> similar to getdata bug:
> LAST_FLAG = 23
> ...
> #define NUMBER_OF_YAP_FLAGS LAST_FLAG
> ...
> #define yap_flags Yap_heap_regs->yap_flags_field
> ...
> Int yap_flags_field[NUMBER_OF_YAP_FLAGS];
> ...
> /* This must be done before initialising predicates */
> for (i = 0; i <= LAST_FLAG; i++) {
> yap_flags[i] = 0;
> }
>
What's wrong with assigning 0 that fits into any intenger? C99 says:
This code is by one element buffer overflowing (not i "<" LAST_FLAG
but i "<=" LAST_FLAG)
Regards,
Mamoru