Out-of-bounds array access in DH key generation

[Stefan Götz]

Compiling with -O3 fails revealing an out-of-bounds access to an array in hipd/dh.c:hip_regen_dh_keys()

lib/core/crypto.h:
#define HIP_MAX_DH_GROUP_ID 7

hipd/dh.c:
DH *dh_table[HIP_MAX_DH_GROUP_ID] = {0};
[...]
    for (i = 1; i <= HIP_MAX_DH_GROUP_ID; i++) {
[...]
            okey = dh_table[i];
            dh_table[i] = tmp;
[...]
    }

It seems that the array dh_table with 7 entries is accessed at index 7, i.e., beyond it's actual size.

[Miika Komu (miika-iki)]

Change the <= to < and commit to trunk? Good catch.

[Stefan Götz (stefan.goetz-deactivatedaccount)]

I think that the iteration should also start at 0 instead of 1, but I hadn't had a closer look. In case similar patterns were copied and pasted, looking at every access to the dh_table array certainly wouldn't hurt before rushing quick fixes.

[Miika Komu (miika-iki)]

Sorry, my bad.