git: DragonFly_RELEASE_6_4 libevtr: Fix off-by-one in string namespace indexing.

[Aaron LI]

commit ad06c2561ec96c0b4ab5b80429a86a6e4004a13f
Author: David Bidner <david at crap.solutions>
Date:   Sat Sep 26 04:57:09 2026 +0200

    libevtr: Fix off-by-one in string namespace indexing.
    
    evtr_dump_string() indexed evtr->strings[ns] although the array is
    sized EVTR_NS_MAX - 1. The namespace IDs are EVTR_NS_PATH=1,
    EVTR_NS_FUNC=2 and EVTR_NS_DSTR=3, so ns == 3 runs one past the array
    and aliases the following union member (fmts): the dynamic-string
    namespace and the format-string table then share a hashtable, and the
    table allocated for that slot by evtr_open_write() leaks.
    
    The read side already uses maps[ns - 1], so make the write side
    consistent and only allocate/free the EVTR_NS_MAX - 1 entries.
    
    Also reject ns == 0 in evtr_load_string(); the old check let it
    through and maps[ns - 1] would read before the array on corrupt input.
    
    Bug: #3424

Summary of changes:
 lib/libevtr/evtr.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/ad06c2561ec96c0b4ab5b80429a86a6e4004a13f


-- 
DragonFly BSD source repository