Merge pull request #7714 from devreal/opal-progress-unregister-oob

bosilca · web-flow · commit 4460e8ba8ee3 · 2020-05-08T16:57:28.000-04:00
Fix potential out-of-bounds write in opal_progress_unregister
diff --git a/opal/runtime/opal_progress.c b/opal/runtime/opal_progress.c
@@ -474,8 +474,8 @@ static int _opal_progress_unregister (opal_progress_callback_t cb, volatile opal
         (void) opal_atomic_swap_ptr ((opal_atomic_intptr_t *) (callback_array + i), (intptr_t) callback_array[i+1]);
     }
 
-    callback_array[*callback_array_len] = fake_cb;
     --*callback_array_len;
+    callback_array[*callback_array_len] = fake_cb;
 
     return OPAL_SUCCESS;
 }

Original file line number	Diff line number	Diff line change
`@@ -474,8 +474,8 @@ static int _opal_progress_unregister (opal_progress_callback_t cb, volatile opal`
`474`	`474`	`(void) opal_atomic_swap_ptr ((opal_atomic_intptr_t *) (callback_array + i), (intptr_t) callback_array[i+1]);`
`475`	`475`	`}`
`476`	`476`
`477`		`- callback_array[*callback_array_len] = fake_cb;`
`478`	`477`	`--*callback_array_len;`
	`478`	`+ callback_array[*callback_array_len] = fake_cb;`
`479`	`479`
`480`	`480`	`return OPAL_SUCCESS;`
`481`	`481`	`}`