out-of-bounds write nn_bitset_one w multiple of 32

nn_bitset_one sets the specified number of bits by first memset'ing the
words, then clearing bits set in a final partial word.  It mishandled
the case where the number of bits is a multiple of 32, clearing the
entire word following the last one it was to touch.

Signed-off-by: Erik Boasson <eb@ilities.com>
This commit is contained in:
Erik Boasson 2019-05-02 11:14:07 +08:00 committed by eboasson
parent c9d827e420
commit fc5a349a72

View file

@ -49,6 +49,7 @@ inline void nn_bitset_one (uint32_t numbits, uint32_t *bits)
memset (bits, 0xff, 4 * ((numbits + 31) / 32));
/* clear bits "accidentally" set */
if ((numbits % 32) != 0)
{
const uint32_t k = numbits / 32;
const uint32_t n = numbits % 32;