[Git][NTPsec/ntpsec][master] ntpd/refclock_oncore.c: tbl[4] index overflow. xiPart of issue #895

[Gary E. Miller (@garyedmundsmiller)]

Gary E. Miller pushed to branch master at NTPsec / ntpsec


Commits:
22a09b3a by Gary E. Miller at 2026-09-28T17:16:17-07:00
ntpd/refclock_oncore.c: tbl[4] index overflow. xiPart of issue #895

Unchecked user byte used as index to array of length 4.

- - - - -


1 changed file:

- ntpd/refclock_oncore.c


Changes:

=====================================
ntpd/refclock_oncore.c
=====================================
@@ -3238,13 +3238,20 @@ oncore_msg_Gc(
         size_t len
         )
 {
-        const char *tbl[] = {"OFF", "ON", "SATELLITE", "TRAIM" };
-
         UNUSED_ARG(len);
 
+        const char *tbl[] = {"OFF", "ON", "SATELLITE", "TRAIM", "Unk"};
+        const char *s;
+
+        if (COUNTOF(tbl) <= buf[4]) {
+            s = tbl[COUNTOF(tbl) - 1];
+        } else {
+            s = tbl[buf[4]];
+        }
+
         instance->pps_control_msg_seen = 1;
-        oncore_log_f(instance, LOG_INFO, "PPS Control set to %s",
-                     tbl[buf[4]]);
+        oncore_log_f(instance, LOG_INFO, "PPS Control set to %s(%u)",
+                     s, buf[4]);
 }
 
 



View it on GitLab: https://gitlab.com/NTPsec/ntpsec/-/commit/22a09b3aec58831a9e4a008f3f22caa155f969c2

-- 
View it on GitLab: https://gitlab.com/NTPsec/ntpsec/-/commit/22a09b3aec58831a9e4a008f3f22caa155f969c2
You're receiving this email because of your account on gitlab.com. Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ntpsec.org/pipermail/vc/attachments/20260929/988b1318/attachment-0001.htm>