A recent Coverity Scan run is complaining about buffer overruns
when accessing the `esp` header member of `struct pkt`:
> CID 379245: Memory - corruptions (OVERRUN)
> Overrunning struct type <unnamed> of 24 bytes by passing it to a function which accesses it at byte offset 25 using argument "len" (which evaluates to 26).
The unnecessary and duplicated `esp.payload` member of `struct pkt` appears
to be the source of confusion:
struct pkt {
int alloc_len;
int len;
struct pkt *next;
union {
struct {
uint32_t spi;
uint32_t seq;
unsigned char iv[16];
unsigned char payload[];
} esp;
/* ...
* other protocols' packet headers
* ...
*/
};
unsigned char data[];
};
It's a flexible array member (`payload[]`), within a union, within a struct
that has another flexible array member (`data[]`); for how these are
supposed to work, see https://en.wikipedia.org/wiki/Flexible_array_member.
The `payload` member is both unused and unnecessary. Let's just remove it.
Signed-off-by: Daniel Lenski <dlenski@gmail.com>
uint32_t spi;
uint32_t seq;
unsigned char iv[16];
- unsigned char payload[];
} esp;
struct {
unsigned char pad[2];