From b7d4313d63c65e99b0c5449068e56d9b8e417c08 Mon Sep 17 00:00:00 2001 From: Daniel Markstedt Date: Sat, 18 Apr 2026 23:51:05 +0200 Subject: [PATCH] libatalk: fix OOB access when "end_of_list_marker" is passed as logtype The bound check in setuplog_internal() compared typenum against num_logtype_strings, which includes the sentinel "end_of_list_marker" entry. This allowed typenum == logtype_end_of_list_marker (11) to pass the guard and index type_configs[] out of bounds (sized for indices 0-10). Fix by comparing against logtype_end_of_list_marker directly, which is the actual size of type_configs[]. --- libatalk/util/logger.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libatalk/util/logger.c b/libatalk/util/logger.c index 84da705f97f..0d9de7de392 100644 --- a/libatalk/util/logger.c +++ b/libatalk/util/logger.c @@ -407,7 +407,7 @@ static void setuplog_internal(const char *loglevel, const char *logtype, } } - if (typenum >= num_logtype_strings) { + if (typenum >= (unsigned int)logtype_end_of_list_marker) { return; }