From: Alejandro Colomar <alx@kernel.org>
Date: Sun, 15 Mar 2026 14:55:30 +0000 (+0100)
Subject: lib/subordinateio.c: find_free_range(): Validate input more carefully
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=65ccd479bdc40b83a42726ceaa16ea97af2a8458;p=thirdparty%2Fshadow.git

lib/subordinateio.c: find_free_range(): Validate input more carefully

Cc: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
---

diff --git a/lib/subordinateio.c b/lib/subordinateio.c
index 33c99f957..a983f9311 100644
--- a/lib/subordinateio.c
+++ b/lib/subordinateio.c
@@ -335,8 +335,7 @@ find_free_range(struct commonio_db *db, id_t min, id_t max, unsigned long count)
 	id_t                           low, high;
 	const struct subordinate_range *range;
 
-	/* When given invalid parameters fail */
-	if ((count == 0) || (max < min)) {
+	if (count == 0 || max < min || count - 1 > max - min) {
 		errno = ERANGE;
 		return -1;
 	}