aboutsummaryrefslogtreecommitdiff
path: root/cddl/contrib/opensolaris/lib/libdtrace
diff options
context:
space:
mode:
authorMark Johnston <markj@FreeBSD.org>2017-08-21 21:56:02 +0000
committerMark Johnston <markj@FreeBSD.org>2017-08-21 21:56:02 +0000
commitce4da6fccce6a1118efaba00c57b5a916295bf6b (patch)
treec3bae0ac50eb5a5923d841bc4c59aac0d1c0bff4 /cddl/contrib/opensolaris/lib/libdtrace
parent3c0e63a4c4fed78c8e1c3e895bcbdd2173f83928 (diff)
downloadsrc-ce4da6fccce6a1118efaba00c57b5a916295bf6b.tar.gz
src-ce4da6fccce6a1118efaba00c57b5a916295bf6b.zip
Fix an off-by-two in the llquantize() action parameter validation.
The aggregation created by llquantize() partitions values into buckets; the lower bound of the bucket containing the largest values is b^{m+1}, where b and m are the second and fourth parameters to the action, respectively. Bucket bounds are stored in a 64-bit integer, and so the llquantize() validation checks need to verify that b^{m+1} fits in 64 bits. However, it was only verifying that b^{m-1} fits in 64 bits, so certain parameter combinations could trigger assertion failures in libdtrace. PR: 219451 MFC after: 1 week
Notes
Notes: svn path=/head/; revision=322773
Diffstat (limited to 'cddl/contrib/opensolaris/lib/libdtrace')
-rw-r--r--cddl/contrib/opensolaris/lib/libdtrace/common/dt_cc.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/cddl/contrib/opensolaris/lib/libdtrace/common/dt_cc.c b/cddl/contrib/opensolaris/lib/libdtrace/common/dt_cc.c
index 1216a389e239..8ec5dd61b8ee 100644
--- a/cddl/contrib/opensolaris/lib/libdtrace/common/dt_cc.c
+++ b/cddl/contrib/opensolaris/lib/libdtrace/common/dt_cc.c
@@ -1503,7 +1503,7 @@ dt_compile_agg(dtrace_hdl_t *dtp, dt_node_t *dnp, dtrace_stmtdesc_t *sdp)
"divide a power of the factor\n");
}
- for (i = 0, order = 1; i < args[2].value; i++) {
+ for (i = 0, order = 1; i <= args[2].value + 1; i++) {
if (order * args[0].value > order) {
order *= args[0].value;
continue;
@@ -1511,7 +1511,7 @@ dt_compile_agg(dtrace_hdl_t *dtp, dt_node_t *dnp, dtrace_stmtdesc_t *sdp)
dnerror(dnp, D_LLQUANT_MAGTOOBIG, "llquantize( ) "
"factor (%d) raised to power of high magnitude "
- "(%d) overflows 64-bits\n", args[0].value,
+ "(%d) plus 1 overflows 64-bits\n", args[0].value,
args[2].value);
}