Fix hash table overflow

There is a flaw in HashTableHash() which means that, for example, an Array
value of 0xff added to an Accumulator value of 0xff will lead to more than
4 bits of Overflow. The 5th bit is missed by the mask and is hence not
folded back into the lower order bits of the Accumulator. The upshot of the
this is an ASSERTion failure for a debug build or an array overflow in the
caller for a non-debug build.
This patch fixes this issue by increasing the overflow mask to 8 bits
instead of 4 (although 5 bit would actually be sufficient).

Signed-off-by: Paul Durrant <paul.durrant@citrix.com>
Reported-by: Rafal Wojdyla <omeg@invisiblethingslab.com>
Tested-by: Rafal Wojdyla <omeg@invisiblethingslab.com>

diff --git a/src/xenbus/hash_table.c b/src/xenbus/hash_table.c
index a9c1b790caf7cfe32ebd3424f837190525e2e1e9..c7c6101001bc5b0843784b55ea387e75de065583 100644 (file)
--- a/src/xenbus/hash_table.c
+++ b/src/xenbus/hash_table.c
@@ -90,7 +90,7 @@ HashTableHash(
 
         Accumulator = (Accumulator << 4) + Array[Index];
 
-        Overflow = Accumulator & 0x00000f00;
+        Overflow = Accumulator & 0x0000ff00;
         if (Overflow != 0) {
             Accumulator ^= Overflow >> 8;
             Accumulator ^= Overflow;