Buffer overflow in machine_list.c

[tyler124]

static boolean m_is_this_slot_in_use [MAX_CONCURRENT_TRANSACTIONS];

...

  i = 0;
  while (m_is_this_slot_in_use[i] && (i < MAX_CONCURRENT_TRANSACTIONS))
    i ++;

Assume MAX_CONCURRENT_TRANSACTIONS = 2

On the first iteration of the loop, m_is_this_slot_in_use[i] will access array index 0, on the second pass array index 1, and on the third pass the out-of-bounds index 2, causing a buffer overflow.

The following simple fix will short-circuit the while loop, preventing the buffer overflow:

while ((i < MAX_CONCURRENT_TRANSACTIONS) && m_is_this_slot_in_use[i])

[skliper]

Closing as obsolete (applies to v2.X)