All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH] fix array index out of bound exception
@ 2021-08-11 13:11 F.A. SULAIMAN
  2021-08-11 14:59 ` Jan Kara
                   ` (3 more replies)
  0 siblings, 4 replies; 9+ messages in thread
From: F.A. SULAIMAN @ 2021-08-11 13:11 UTC (permalink / raw)
  To: jack; +Cc: F.A.Sulaiman, linux-kernel

From: "F.A.Sulaiman" <asha.16@itfac.mrt.ac.lk>

Array index out of bound exception occurs when the 'part' variable is passed into the freeSpactTable array, 
this can be avoided using pointer arithmetic. 

Signed-off-by: F.A. SULAIMAN <asha.16@itfac.mrt.ac.lk>
---
 fs/udf/super.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/udf/super.c b/fs/udf/super.c
index 2f83c1204e20..d330c7162c3a 100644
--- a/fs/udf/super.c
+++ b/fs/udf/super.c
@@ -2522,7 +2522,7 @@ static unsigned int udf_count_free(struct super_block *sb)
 			sbi->s_lvid_bh->b_data;
 		if (le32_to_cpu(lvid->numOfPartitions) > part) {
 			accum = le32_to_cpu(
-					lvid->freeSpaceTable[part]);
+					(lvid->freeSpaceTable + part));
 			if (accum == 0xFFFFFFFF)
 				accum = 0;
 		}
-- 
2.17.1


^ permalink raw reply related	[flat|nested] 9+ messages in thread
* [PATCH] Fix array index out of bound exception
@ 2018-03-06 10:07 Lianbo Jiang
  0 siblings, 0 replies; 9+ messages in thread
From: Lianbo Jiang @ 2018-03-06 10:07 UTC (permalink / raw)
  To: kexec

A data overflow may lead to a reversal, which may turn a positive
number into a large negative number, in this case, the string's
length will exceed the array size(for example, eta: -2147483648s),
here the array size is defined 16 characters. So, it is nessasary
to consider some exceptions.

Signed-off-by: Lianbo Jiang <lijiang@redhat.com>
---
 print_info.c | 21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/print_info.c b/print_info.c
index e0e6a27..09e215a 100644
--- a/print_info.c
+++ b/print_info.c
@@ -16,6 +16,8 @@
 #include "print_info.h"
 #include <time.h>
 #include <string.h>
+#include <stdint.h>
+#include <inttypes.h>
 
 #define PROGRESS_MAXLEN		"50"
 
@@ -352,18 +354,21 @@ static void calc_delta(struct timeval *tv_start, struct timeval *delta)
 }
 
 /* produce less than 12 bytes on msg */
-static int eta_to_human_short (int secs, char* msg)
+static int eta_to_human_short (int64_t secs, char* msg, int maxsize)
 {
 	strcpy(msg, "eta: ");
 	msg += strlen("eta: ");
 	if (secs < 100)
-		sprintf(msg, "%ds", secs);
+		snprintf(msg, maxsize, "%"PRId64"s", secs);
 	else if (secs < 100 * 60)
-		sprintf(msg, "%dm%ds", secs / 60, secs % 60);
+		snprintf(msg, maxsize, "%"PRId64"m""%"PRId64"s",
+			secs / 60, secs % 60);
 	else if (secs < 48 * 3600)
-		sprintf(msg, "%dh%dm", secs / 3600, (secs / 60) % 60);
+		snprintf(msg, maxsize, "%"PRId64"h""%"PRId64"m",
+			secs / 3600, (secs / 60) % 60);
 	else if (secs < 100 * 86400)
-		sprintf(msg, "%dd%dh", secs / 86400, (secs / 3600) % 24);
+		snprintf(msg, maxsize, "%"PRId64"d""%"PRId64"h",
+			secs / 86400, (secs / 3600) % 24);
 	else
 		sprintf(msg, ">2day");
 	return 0;
@@ -379,8 +384,8 @@ print_progress(const char *msg, unsigned long current, unsigned long end, struct
 	static unsigned int lapse = 0;
 	static const char *spinner = "/|\\-";
 	struct timeval delta;
-	double eta;
-	char eta_msg[16] = " ";
+	int64_t eta;
+	char eta_msg[32] = " ";
 
 	if (current < end) {
 		tm = time(NULL);
@@ -395,7 +400,7 @@ print_progress(const char *msg, unsigned long current, unsigned long end, struct
 		calc_delta(start, &delta);
 		eta = delta.tv_sec + delta.tv_usec / 1e6;
 		eta = (100 - progress) * eta / progress;
-		eta_to_human_short(eta, eta_msg);
+		eta_to_human_short(eta, eta_msg, sizeof(eta_msg));
 	}
 	if (flag_ignore_r_char) {
 		PROGRESS_MSG("%-" PROGRESS_MAXLEN "s: [%5.1f %%] %c  %16s\n",
-- 
2.9.5


_______________________________________________
kexec mailing list
kexec@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/kexec

^ permalink raw reply related	[flat|nested] 9+ messages in thread
end of thread, other threads:[~2021-08-11 17:24 UTC | newest]

Thread overview: 9+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2021-08-11 13:11 [PATCH] fix array index out of bound exception F.A. SULAIMAN
2021-08-11 14:59 ` Jan Kara
2021-08-11 16:31 ` kernel test robot
2021-08-11 16:31   ` kernel test robot
2021-08-11 17:23 ` kernel test robot
2021-08-11 17:23   ` kernel test robot
2021-08-11 17:24 ` kernel test robot
2021-08-11 17:24   ` kernel test robot
  -- strict thread matches above, loose matches on Subject: below --
2018-03-06 10:07 [PATCH] Fix " Lianbo Jiang

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.