Attention is currently required from: fixeria, laforge, n0k0, pespin. Hello Jenkins Builder, fixeria, laforge, pespin, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/libasn1c/+/42890?usp=email to look at the new patch set (#4). The following approvals got outdated and were removed: Code-Review+1 by fixeria, Code-Review+1 by laforge, Code-Review+2 by pespin, Verified-1 by Jenkins Builder Change subject: constr_CHOICE: fix always-true bounds check ...................................................................... constr_CHOICE: fix always-true bounds check The guard around the td->elements[present - 1] access uses "present > 0 || present <= td->elements_count". Because every int satisfies at least one of the two clauses, the condition is always true, so a present index of 0 or one greater than elements_count indexes the elements array out of bounds (out of bounds read). Use "&&" so the access is taken only when present is within [1, elements_count], matching the equivalent checks already used in CHOICE_constraint() and the print/compare helpers in this file. Change-Id: I25e414729f314505bce50bd8107d61bb1e3a44bf --- M src/constr_CHOICE.c 1 file changed, 1 insertion(+), 1 deletion(-) git pull ssh://gerrit.osmocom.org:29418/libasn1c refs/changes/90/42890/4 -- To view, visit https://gerrit.osmocom.org/c/libasn1c/+/42890?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: libasn1c Gerrit-Branch: master Gerrit-Change-Id: I25e414729f314505bce50bd8107d61bb1e3a44bf Gerrit-Change-Number: 42890 Gerrit-PatchSet: 4 Gerrit-Owner: n0k0 <osmocom@hacky.software> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy@sysmocom.de> Gerrit-Reviewer: laforge <laforge@osmocom.org> Gerrit-Reviewer: pespin <pespin@sysmocom.de> Gerrit-CC: lynxis lazus <lynxis@fe80.eu> Gerrit-Attention: laforge <laforge@osmocom.org> Gerrit-Attention: n0k0 <osmocom@hacky.software> Gerrit-Attention: fixeria <vyanitskiy@sysmocom.de> Gerrit-Attention: pespin <pespin@sysmocom.de>