]> git.ipfire.org Git - thirdparty/xfsprogs-dev.git/commit
xfsprogs: avoid array overflow in pf_batch_read()
authorEric Sandeen <sandeen@redhat.com>
Fri, 30 Aug 2013 03:55:16 +0000 (03:55 +0000)
committerRich Johnston <rjohnston@sgi.com>
Thu, 17 Oct 2013 18:50:02 +0000 (13:50 -0500)
commite49f30a76f5e910092bd285ebef3f7641a09ec2e
tree8fbe1560be86ccc223fdd9d72213a19663659b79
parente6efb967e61a366dbe877f34e220e32866e7db42
xfsprogs: avoid array overflow in pf_batch_read()

The while loop in pf_batch_read, and the code preceding it, is really...
quite a thing.  I'd love to rewrite it, but I haven't yet found
a particularly cleaner way.

It cleverly hides the fact that we might increment "num" past the
last index of bplist[] and then assign to it.  This corrupts memory.

Rather than major surgery for now, just go for the simple fix,
and break out of the loop if we've increased "num" past the
last index.

Signed-off-by: Eric Sandeen <sandeen@redhat.com>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
Signed-off-by: Rich Johnston <rjohnston@sgi.com>
repair/prefetch.c