xfsprogs: avoid array overflow in pf_batch_read()

The while loop in pf_batch_read, and the code preceding it, is really...
quite a thing.  I'd love to rewrite it, but I haven't yet found
a particularly cleaner way.

It cleverly hides the fact that we might increment "num" past the
last index of bplist[] and then assign to it.  This corrupts memory.

Rather than major surgery for now, just go for the simple fix,
and break out of the loop if we've increased "num" past the
last index.

Signed-off-by: Eric Sandeen <sandeen@redhat.com>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
Signed-off-by: Rich Johnston <rjohnston@sgi.com>

diff --git a/repair/prefetch.c b/repair/prefetch.c
index 7529f5dd14f04edeb90b1fe6242c824bd501e5b1..d3491da2af0aa70adbbb3f1b845cf27dadcbc108 100644 (file)
--- a/repair/prefetch.c
+++ b/repair/prefetch.c
@@ -429,6 +429,8 @@ pf_batch_read(
                        if (which != PF_META_ONLY ||
                            !B_IS_INODE(XFS_BUF_PRIORITY(bplist[num])))
                                num++;
+                       if (num == MAX_BUFS)
+                               break;
                        bplist[num] = btree_lookup_next(args->io_queue, &fsbno);
                }
                if (!num)