libext2fs: fix binary search for the icount and badblocks stores

Remove the interpolation because there is a bug in icount which can
cause a core dump if calculated range gets turned into a NaN and then
do an out-of-bounds array access.  We could fix this with some more
tests, but the complexity is such that nuking all of the interpolation
code will be faster than fixing the interpolation.

Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>

diff --git a/lib/ext2fs/badblocks.c b/lib/ext2fs/badblocks.c
index 5eb28b7864a71e3471f364a37e9019e0c7af1e7b..4312e1906ed9c35c1b3f1bbdd8b0195e6979876a 100644 (file)
--- a/lib/ext2fs/badblocks.c
+++ b/lib/ext2fs/badblocks.c
@@ -177,7 +177,7 @@ int ext2fs_u32_list_find(ext2_u32_list bb, __u32 blk)
                return high;
 
        while (low < high) {
-               mid = (low+high)/2;
+               mid = ((unsigned)low + (unsigned)high)/2;
                if (mid == low || mid == high)
                        break;
                if (blk == bb->list[mid])

diff --git a/lib/ext2fs/icount.c b/lib/ext2fs/icount.c
index 43cc53e1a4642bdecac28a1d4f1885618f1dea35..9223f662e2a0c752ab1d12281ac293938e7db80d 100644 (file)
--- a/lib/ext2fs/icount.c
+++ b/lib/ext2fs/icount.c
@@ -363,31 +363,7 @@ static struct ext2_icount_el *get_icount_el(ext2_icount_t icount,
        low = 0;
        high = (int) icount->count-1;
        while (low <= high) {
-#if 0
-               mid = (low+high)/2;
-#else
-               if (low == high)
-                       mid = low;
-               else {
-                       /* Interpolate for efficiency */
-                       lowval = icount->list[low].ino;
-                       highval = icount->list[high].ino;
-
-                       if (ino < lowval)
-                               range = 0;
-                       else if (ino > highval)
-                               range = 1;
-                       else {
-                               range = ((float) (ino - lowval)) /
-                                       (highval - lowval);
-                               if (range > 0.9)
-                                       range = 0.9;
-                               if (range < 0.1)
-                                       range = 0.1;
-                       }
-                       mid = low + ((int) (range * (high-low)));
-               }
-#endif
+               mid = ((unsigned)low + (unsigned)high) >> 1;
                if (ino == icount->list[mid].ino) {
                        icount->cursor = mid+1;
                        return &icount->list[mid];