[med-svn] [aghermann] 25/34: libmetrics/swu, mc: prevent improper memory reads in corner cases

[andrei zavada]

This is an automated email from the git hooks/post-receive script.

hmmr-guest pushed a commit to branch master
in repository aghermann.

commit c87b716ee8a7498d759f82710d114e339d48a893
Author: Andrei Zavada <hmmr at ra>
Date:   Sat Nov 16 01:47:56 2013 +0200

    libmetrics/swu,mc: prevent improper memory reads in corner cases
---
 upstream/src/libmetrics/mc.hh  | 7 ++++++-
 upstream/src/libmetrics/swu.cc | 2 +-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/upstream/src/libmetrics/mc.hh b/upstream/src/libmetrics/mc.hh
index 5af7d54..2b30dea 100644
--- a/upstream/src/libmetrics/mc.hh
+++ b/upstream/src/libmetrics/mc.hh
@@ -221,7 +221,12 @@ do_sssu_reduction( const valarray<T>& S,
                 ss (lpages),
                 su (lpages);
         for ( size_t p = 0; p < lpages; ++p ) {
-                auto range = slice (p * inc_samples, scope_samples, 1);
+                if ( unlikely (p * inc_samples + scope_samples-1 >= due_filtered.size()) ) {
+                        // printf ("WTF? %zu >= %zu\n", p * inc_samples + scope_samples-1, due_filtered.size());
+                        // happened at pagesize 4; just make it stop
+                        break;
+                }
+                auto range = slice (p * inc_samples, scope_samples-1, 1);
                 su[p] =
                         (valarray<T> {due_filtered[range]} * valarray<T> {se_filtered[range]})
                         .sum() / scope_samples;
diff --git a/upstream/src/libmetrics/swu.cc b/upstream/src/libmetrics/swu.cc
index 63e40fe..f9d23e9 100644
--- a/upstream/src/libmetrics/swu.cc
+++ b/upstream/src/libmetrics/swu.cc
@@ -97,7 +97,7 @@ go_compute()
                 for ( auto i = a; i < z; ++i ) {
                         double q = 0.;
                         auto j = i;
-                        while ( dS[j] > 0 ) {
+                        while ( j < dS.size() && dS[j] > 0 ) {
                                 q += dS[j];
                                 if ( not (j < z) )
                                         break;

-- 
Alioth's /git/debian-med/git-commit-notice on /srv/git.debian.org/git/debian-med/aghermann.git