- libopm.c: fixed an off by one in opm_callback() and libopm_do_callback() that poten...

  allowed to write to out-of-bounds memory

git-svn-id: svn://svn.ircd-hybrid.org/svnroot/hopm/trunk@5673 82007160-df01-0410-b94d-b575c5fd34c7

diff --git a/src/libopm/src/libopm.c b/src/libopm/src/libopm.c
index cc1c4383250c14f31a8d38d7275b1455897e78ae..f5735f9b5a058701aadebbe25e0d0b33fab9175b 100644 (file)
--- a/src/libopm/src/libopm.c
+++ b/src/libopm/src/libopm.c
@@ -197,7 +197,7 @@ opm_remote_free(OPM_REMOTE_T *remote)
 OPM_ERR_T
 opm_callback(OPM_T *scanner, int type, OPM_CALLBACK_FUNC *function, void *data)
 {
-  if (type < 0 || type >= (CBLEN + 1))
+  if (type < 0 || type >= CBLEN)
     return OPM_ERR_CBNOTFOUND;
 
   scanner->callbacks[type].func = function;
@@ -1276,7 +1276,7 @@ static void
 libopm_do_callback(OPM_T *scanner, OPM_REMOTE_T *remote, int type, int var)
 {
   /* Callback is out of range */
-  if (type < 0 || type >= (CBLEN + 1))
+  if (type < 0 || type >= CBLEN)
     return;
 
   if (scanner->callbacks[type].func)