From: Eric Sandeen <sandeen@redhat.com>
To: xfs-oss <xfs@oss.sgi.com>
Subject: [PATCH] xfsprogs: avoid array overflow in pf_batch_read()
Date: Thu, 29 Aug 2013 22:55:16 -0500 [thread overview]
Message-ID: <522017A4.8060400@redhat.com> (raw)
The while loop in pf_batch_read, and the code preceeding it, is really...
quite a thing. I'd love to rewrite it, but I haven't yet found
a particularly cleaner way.
It cleverly hides the fact that we might increment "num" past the
last index of bplist[] and then assign to it. This corrupts memory.
Rather than major surgery for now, just go for the simple fix,
and break out of the loop if we've increased "num" past the
last index.
Signed-off-by: Eric Sandeen <sandeen@redhat.com>
---
diff --git a/repair/prefetch.c b/repair/prefetch.c
index 7529f5d..d3491da 100644
--- a/repair/prefetch.c
+++ b/repair/prefetch.c
@@ -429,6 +429,8 @@ pf_batch_read(
if (which != PF_META_ONLY ||
!B_IS_INODE(XFS_BUF_PRIORITY(bplist[num])))
num++;
+ if (num == MAX_BUFS)
+ break;
bplist[num] = btree_lookup_next(args->io_queue, &fsbno);
}
if (!num)
_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs
next reply other threads:[~2013-08-30 3:55 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-08-30 3:55 Eric Sandeen [this message]
2013-09-02 10:14 ` [PATCH] xfsprogs: avoid array overflow in pf_batch_read() Dave Chinner
2013-10-18 16:29 ` Rich Johnston
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=522017A4.8060400@redhat.com \
--to=sandeen@redhat.com \
--cc=xfs@oss.sgi.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox