* grub-core/fs/romfs.c (grub_romfs_mount): Fix pointer comparison

	overflow.

diff --git a/ChangeLog b/ChangeLog
index 2859e1a7b8a396d6453b10be5bd0d4b9e93c6c6e..d3d7f0ea7f342d2735497453adbdf419eab17959 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2011-12-13  Vladimir Serbinenko  <phcoder@gmail.com>
+
+       * grub-core/fs/romfs.c (grub_romfs_mount): Fix pointer comparison
+       overflow.
+
 2011-12-13  Vladimir Serbinenko  <phcoder@gmail.com>
 
        * grub-core/fs/squash4.c (grub_squash_inode): Fix field sizes.

diff --git a/grub-core/fs/romfs.c b/grub-core/fs/romfs.c
index 76e13727d47900e57aba008b3220220cf6eaf916..11c844e911f32dc34a1dcabde7a3c59f1bd8b768 100644 (file)
--- a/grub-core/fs/romfs.c
+++ b/grub-core/fs/romfs.c
@@ -112,7 +112,7 @@ grub_romfs_mount (grub_device_t dev)
   if (err)
     return NULL;
   for (ptr = sb.sb.label; (void *) ptr < (void *) (&sb + 1)
-        && ptr < sb.d + grub_be_to_cpu32 (sb.sb.total_size); ptr++)
+        && ptr - sb.d < (grub_ssize_t) grub_be_to_cpu32 (sb.sb.total_size); ptr++)
     if (!*ptr)
       break;
   if ((void *) ptr == &sb + 1)
@@ -124,7 +124,7 @@ grub_romfs_mount (grub_device_t dev)
        if (err)
          return NULL;
        for (ptr = sb.d; (void *) ptr < (void *) (&sb + 1)
-              && ptr < sb.d + grub_be_to_cpu32 (sb.sb.total_size); ptr++)
+              && ptr - sb.d < (grub_ssize_t) grub_be_to_cpu32 (sb.sb.total_size); ptr++)
          if (!*ptr)
            break;
       }