The code in udp_invert_portmap() is written based on an incorrect understanding of C's (arcane) integer promotion rules. We calculate '(in_port_t)i + delta' expecting the result to be of type in_port_t (16 bits). However "small integer types" (those narrower than 'int') are always promoted to int for expressions, meaning this calculation can overrun the rdelta[] array. Fix this, and use a new intermediate for the index, to make it very clear what it's type is. We also change i to unsigned, to avoid any possible confusion from mixing signed and unsigned types. Link: https://bugs.passt.top/show_bug.cgi?id=80 Reported-by: Laurent Jacquot <jk(a)lutty.net> Suggested-by: Laurent Jacquot <jk(a)lutty.net> Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- udp.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/udp.c b/udp.c index c031a053..a3961bfd 100644 --- a/udp.c +++ b/udp.c @@ -258,15 +258,16 @@ void udp_portmap_clear(void) */ static void udp_invert_portmap(struct udp_port_fwd *fwd) { - int i; + unsigned int i; static_assert(ARRAY_SIZE(fwd->f.delta) == ARRAY_SIZE(fwd->rdelta), "Forward and reverse delta arrays must have same size"); for (i = 0; i < ARRAY_SIZE(fwd->f.delta); i++) { in_port_t delta = fwd->f.delta[i]; + in_port_t rport = i + delta; if (delta) - fwd->rdelta[(in_port_t)i + delta] = NUM_PORTS - delta; + fwd->rdelta[rport] = NUM_PORTS - delta; } } -- 2.43.2