From 3d2b982fb758ffc781132b7ebec878b64ea94fa0 Mon Sep 17 00:00:00 2001 From: Thomas Haller Date: Fri, 13 Mar 2020 12:17:18 +0100 Subject: [PATCH] cli: fix out of bounds access in _print_fill() cols_len might be larger than header_row->len. That is when the cols has entries that are not leaf entries (which currently I think is never the case). Fix it to use the right variable for the length of the row. --- clients/cli/utils.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/clients/cli/utils.c b/clients/cli/utils.c index d35ed2663..d8524c55a 100644 --- a/clients/cli/utils.c +++ b/clients/cli/utils.c @@ -1140,7 +1140,8 @@ _print_fill (const NmcConfig *nmc_config, header_cell->width = nmc_string_screen_width (header_cell->title, NULL); for (i_row = 0; i_row < targets_len; i_row++) { - const PrintDataCell *cell = &g_array_index (cells, PrintDataCell, i_row * cols_len + i_col); + const PrintDataCell *cells_line = &g_array_index (cells, PrintDataCell, i_row * header_row->len); + const PrintDataCell *cell = &cells_line[i_col]; const char *const*i_strv; switch (cell->text_format) {