Merge pull request #10964 from devreal/fix-han-mod_id-overflow

devreal · web-flow · commit 31b0fa6f02bd · 2022-10-26T08:42:51.000-04:00
Fix potential oob read in mca_coll_han_query_module_from_mca
diff --git a/ompi/mca/coll/han/coll_han_component.c b/ompi/mca/coll/han/coll_han_component.c
@@ -213,9 +213,8 @@ mca_coll_han_query_module_from_mca(mca_base_component_t* c,
 {
     char *module_name, *endptr = NULL;
 
-    int mod_id = COMPONENTS_COUNT;
+    int mod_id = COMPONENTS_COUNT-1;
     mod_id = (*module_id > (uint32_t)mod_id) ? mod_id : (int)*module_id; /* stay in range */
-    mod_id = (mod_id < 0) ? 0 : mod_id;  /* in range */
 
     *storage = ompi_coll_han_available_components[mod_id].component_name;
 

Original file line number	Diff line number	Diff line change
`@@ -213,9 +213,8 @@ mca_coll_han_query_module_from_mca(mca_base_component_t* c,`
`213`	`213`	`{`
`214`	`214`	`char module_name, endptr = NULL;`
`215`	`215`
`216`		`- int mod_id = COMPONENTS_COUNT;`
	`216`	`+ int mod_id = COMPONENTS_COUNT-1;`
`217`	`217`	`mod_id = (module_id > (uint32_t)mod_id) ? mod_id : (int)module_id; /* stay in range */`
`218`		`- mod_id = (mod_id < 0) ? 0 : mod_id; /* in range */`
`219`	`218`
`220`	`219`	`*storage = ompi_coll_han_available_components[mod_id].component_name;`
`221`	`220`