Hi,
MSGMNI should be limited to MAXNPROCS, since keyarray[] only has MAXNPROCS
entries.  Without this, the loop at lines 177-181
        for (i = 0; i < nprocs; i++) {
                ok = 1;
                do {
                        /* Get random key */
                        keyarray[i] = (key_t) rand();

can write past the end of keyarray[] if there are > MAXNPROCS free message
queues.

The patch:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
diff -r 15082dabc40b testcases/kernel/syscalls/ipc/msgctl/msgctl10.c
--- a/testcases/kernel/syscalls/ipc/msgctl/msgctl10.c   Mon Sep 13 10:38:06
2010 -0400
+++ b/testcases/kernel/syscalls/ipc/msgctl/msgctl10.c   Mon Sep 13 10:53:32
2010 -0400
@@ -452,6 +452,8 @@
                cleanup();

        MSGMNI = nr_msgqs - get_used_msgqueues();
+       if( MSGMNI > MAXNPROCS  )
+               MSGMNI = MAXNPROCS;
        if (MSGMNI <= 0) {
                tst_resm(TBROK,
                         "Max number of message queues already used, cannot
create more.");
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

--
Scott Romanowski
------------------------------------------------------------------------------
Start uncovering the many advantages of virtual appliances
and start using them to simplify application deployment and
accelerate your shift to cloud computing
http://p.sf.net/sfu/novell-sfdev2dev
_______________________________________________
Ltp-list mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/ltp-list

Reply via email to