+-- On Wed, 20 Nov 2019, Paul Mackerras wrote --+
| Still not right, I'm afraid, since it could leave src->output set to
| 3, which would lead to an out-of-bounds array access. I think it
| needs to be
===
#include <stdio.h>
int
main (int argc, char *argv[])
{
int i = 0;
for (i = 0; i < 1024; i++) {
printf ("%d: %d\n", i, i % 0x3);
}
return 0;
}
-> https://paste.centos.org/view/fb14b3cf
===
It does not seem to set it to 0x3. When a no is divisible by 0x3,
'src->output' will be set to zero(0).
Thank you.
--
Prasad J Pandit / Red Hat Product Security Team
8685 545E B54C 486B C6EB 271E E285 8B5A F050 DE8D
