From 06a870c232513aca96a624535d648a6e7c098e5f Mon Sep 17 00:00:00 2001 From: "Lubomir I. Ivanov" Date: Tue, 19 Jun 2018 03:59:33 +0300 Subject: equipment: sanitize 'ws_info' loop limits Instead of a constant or a macro for the maximum number of 'ws_info' elements the 100 literal was used. Define MAX_WS_INFO in dive.h and use it everywhere. Also clamp loops that iterate `ws_info' to MAX_WS_INFO. Prevents potential out-of-bounds reading, similarly to the previous commit about 'tank_info'. Signed-off-by: Lubomir I. Ivanov --- qt-models/weightmodel.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'qt-models/weightmodel.cpp') diff --git a/qt-models/weightmodel.cpp b/qt-models/weightmodel.cpp index 77114eaea..b8e9ffa5d 100644 --- a/qt-models/weightmodel.cpp +++ b/qt-models/weightmodel.cpp @@ -107,7 +107,7 @@ bool WeightModel::setData(const QModelIndex &index, const QVariant &value, int r if (!ws->description || gettextFromC::tr(ws->description) != vString) { // loop over translations to see if one matches int i = -1; - while (ws_info[++i].name) { + while (ws_info[++i].name && i < MAX_WS_INFO) { if (gettextFromC::tr(ws_info[i].name) == vString) { ws->description = copy_string(ws_info[i].name); break; -- cgit v1.2.3-70-g09d2