From 34b2a4a1f9794498ca403393003cc5840c240d42 Mon Sep 17 00:00:00 2001 From: Theodore Ts'o Date: Mon, 9 Jun 2025 11:30:48 -0400 Subject: [PATCH] libext2fs: fix integer overflow in ext2fs_punch() when releasing more than 2**31 blocks Addresses-Debian-Bug: #1106241 Signed-off-by: Theodore Ts'o --- lib/ext2fs/punch.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/lib/ext2fs/punch.c b/lib/ext2fs/punch.c index e2543e1e7..80c699eb0 100644 --- a/lib/ext2fs/punch.c +++ b/lib/ext2fs/punch.c @@ -193,10 +193,10 @@ static void dbg_print_extent(char *desc, struct ext2fs_extent *extent) static errcode_t punch_extent_blocks(ext2_filsys fs, ext2_ino_t ino, struct ext2_inode *inode, blk64_t lfree_start, blk64_t free_start, - __u32 free_count, int *freed) + __u32 free_count, blk64_t *freed) { blk64_t pblk; - int freed_now = 0; + __u32 freed_now = 0; __u32 cluster_freed; errcode_t retval = 0; @@ -271,7 +271,7 @@ static errcode_t ext2fs_punch_extent(ext2_filsys fs, ext2_ino_t ino, errcode_t retval; blk64_t free_start, next, lfree_start; __u32 free_count, newlen; - int freed = 0; + blk64_t freed = 0; int op; retval = ext2fs_extent_open2(fs, ino, inode, &handle); @@ -442,7 +442,7 @@ static errcode_t ext2fs_punch_extent(ext2_filsys fs, ext2_ino_t ino, if (retval) goto errout; } - dbg_printf("Freed %d blocks\n", freed); + dbg_printf("Freed %llu blocks\n", freed); retval = ext2fs_iblk_sub_blocks(fs, inode, freed); errout: ext2fs_extent_free(handle); -- 2.47.3