[PATCH 1/2] xfs_repair: do not allow cache growth to overflow

["user.mail" <sandeen@redhat.com>]

Nothing stops cache_expand() from growing c_maxcount (via *2)
repeatedly until it overflows.

Add a bounds check here and return failure if for any reason we try to
grow too much.

Signed-off-by: Eric Sandeen <sandeen@redhat.com>
Signed-off-by: user.mail <sandeen@redhat.com>
---
 libxfs/cache.c | 20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/libxfs/cache.c b/libxfs/cache.c
index d5d9ba56..f8be9b89 100644
--- a/libxfs/cache.c
+++ b/libxfs/cache.c
@@ -79,16 +79,23 @@ cache_init(
 	return cache;
 }
 
-static void
+static int
 cache_expand(
 	struct cache *		cache)
 {
+	int			success = 1;
 	pthread_mutex_lock(&cache->c_mutex);
+	if (cache->c_maxcount <= UINT_MAX/2) {
 #ifdef CACHE_DEBUG
-	fprintf(stderr, "doubling cache size to %u\n", 2 * cache->c_maxcount);
+		fprintf(stderr, "doubling cache size to %u\n",
+			2 * cache->c_maxcount);
 #endif
-	cache->c_maxcount *= 2;
+		cache->c_maxcount *= 2;
+	} else
+		success = 0;
 	pthread_mutex_unlock(&cache->c_mutex);
+
+	return success;
 }
 
 void
@@ -468,7 +475,8 @@ next_object:
 		 */
 		if (priority > CACHE_MAX_PRIORITY) {
 			priority = 0;
-			cache_expand(cache);
+			if (!cache_expand(cache))
+				goto fail;
 		}
 	}
 
@@ -488,6 +496,10 @@ next_object:
 
 	*nodep = node;
 	return 1;
+
+fail:
+	*nodep = NULL;
+	return -1;
 }
 
 void
-- 
2.55.0