tc: util: fix print_rate for ludicrous speeds

The for loop should only probe up to G[i]bit rates, so that we
end up with T[i]bit as the last max units[] slot for snprintf(3),
and not possibly an invalid pointer in case rate is multiple of
kilo.

Fixes: 8cecdc283743 ("tc: more user friendly rates")
Reported-by: Jose R. Guzman Mosqueda <jose.r.guzman.mosqueda@intel.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>

diff --git a/tc/tc_util.c b/tc/tc_util.c
index dc2b70faec01274af674250093ac9537f3b9f898..aa6de2448bf2e3ef93e4d7f304a688f7f124ebab 100644 (file)
--- a/tc/tc_util.c
+++ b/tc/tc_util.c
@@ -250,18 +250,19 @@ void print_rate(char *buf, int len, __u64 rate)
        extern int use_iec;
        unsigned long kilo = use_iec ? 1024 : 1000;
        const char *str = use_iec ? "i" : "";
-       int i = 0;
        static char *units[5] = {"", "K", "M", "G", "T"};
+       int i;
 
        rate <<= 3; /* bytes/sec -> bits/sec */
 
-       for (i = 0; i < ARRAY_SIZE(units); i++)  {
+       for (i = 0; i < ARRAY_SIZE(units) - 1; i++)  {
                if (rate < kilo)
                        break;
                if (((rate % kilo) != 0) && rate < 1000*kilo)
                        break;
                rate /= kilo;
        }
+
        snprintf(buf, len, "%.0f%s%sbit", (double)rate, units[i], str);
 }