From ebc77551e90793e1cd5403cb740c70b13403ecfd Mon Sep 17 00:00:00 2001 From: Craig Tiller Date: Wed, 7 Dec 2016 11:25:11 -0800 Subject: Fix memory overrun --- src/core/lib/transport/static_metadata.c | 2 +- tools/codegen/core/gen_static_metadata.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/core/lib/transport/static_metadata.c b/src/core/lib/transport/static_metadata.c index ee1e22b2b2..807adfef54 100644 --- a/src/core/lib/transport/static_metadata.c +++ b/src/core/lib/transport/static_metadata.c @@ -440,7 +440,7 @@ static uint32_t elems_phash(uint32_t i) { i -= 42; uint32_t x = i % 96; uint32_t y = i / 96; - return x + (uint32_t)elems_r[y]; + return y < GPR_ARRAY_SIZE(elems_r) ? x + (uint32_t)elems_r[y] : 0; } static const uint16_t elem_keys[] = { diff --git a/tools/codegen/core/gen_static_metadata.py b/tools/codegen/core/gen_static_metadata.py index b7c9533602..1a2911cd04 100755 --- a/tools/codegen/core/gen_static_metadata.py +++ b/tools/codegen/core/gen_static_metadata.py @@ -424,7 +424,7 @@ static uint32_t %(name)s_phash(uint32_t i) { i %(offset_sign)s= %(offset)d; uint32_t x = i %% %(t)d; uint32_t y = i / %(t)d; - return x + (uint32_t)%(name)s_r[y]; + return y < GPR_ARRAY_SIZE(%(name)s_r) ? x + (uint32_t)%(name)s_r[y] : 0; } """ % { 'name': name, -- cgit v1.2.3