From bca45352395a526b5e32a67b96ac0ccb2bbe6204 Mon Sep 17 00:00:00 2001
From: PieterPan <haiku@panman.eu>
Date: Sat, 16 Nov 2013 23:17:44 +0000
Subject: [PATCH] Devices: Check out of bound array access on category strings.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* Computes the length of the category strings array.
* Checks against this length before accessing the array
* Improves comment
* Should fix #10186

Signed-off-by: Jérôme Duval <jerome.duval@gmail.com>
---
 src/apps/devices/Device.cpp      | 3 ++-
 src/apps/devices/Device.h        | 1 +
 src/apps/devices/DevicesView.cpp | 7 +++++++
 3 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/src/apps/devices/Device.cpp b/src/apps/devices/Device.cpp
index d306bc850d..bc92b7b913 100644
--- a/src/apps/devices/Device.cpp
+++ b/src/apps/devices/Device.cpp
@@ -16,7 +16,7 @@
 #undef B_TRANSLATION_CONTEXT
 #define B_TRANSLATION_CONTEXT "Device"
 
-// This list comes from the pciid list, except for the last one
+// This list comes from the pciid list, except for the last ones
 const char* kCategoryString[] = {
 	B_TRANSLATE("Unclassified device"), 				// 0x00
 	B_TRANSLATE("Mass storage controller"),				// 0x01
@@ -39,6 +39,7 @@ const char* kCategoryString[] = {
 	B_TRANSLATE("Computer"),							// 0x12 (added later)
 	B_TRANSLATE("ACPI controller")						// 0x13 (added later)
 };
+const int kCategoryStringLength	= sizeof(kCategoryString)/sizeof(char *);
 
 // This list is only used to translate Device properties
 B_TRANSLATE_MARK_VOID("unknown");
diff --git a/src/apps/devices/Device.h b/src/apps/devices/Device.h
index caf36db3d3..32b2e03a9d 100644
--- a/src/apps/devices/Device.h
+++ b/src/apps/devices/Device.h
@@ -68,6 +68,7 @@ typedef enum {
 
 
 extern const char* kCategoryString[];
+extern const int kCategoryStringLength;
 
 
 class Device : public BStringItem {
diff --git a/src/apps/devices/DevicesView.cpp b/src/apps/devices/DevicesView.cpp
index c14111bcc7..87609734b7 100644
--- a/src/apps/devices/DevicesView.cpp
+++ b/src/apps/devices/DevicesView.cpp
@@ -146,6 +146,13 @@ DevicesView::CreateCategoryMap()
 	CategoryMapIterator iter;
 	for (unsigned int i = 0; i < fDevices.size(); i++) {
 		Category category = fDevices[i]->GetCategory();
+		if (category < 0 || category >= kCategoryStringLength) {
+			std::cerr << "CreateCategoryMap: device " << fDevices[i]->GetName()
+				<< " returned an unknown category index (" << category << "). "
+				<< "Skipping device." << std::endl;
+			continue;
+		}
+
 		const char* categoryName = kCategoryString[category];
 
 		iter = fCategoryMap.find(category);