Skip to contentSkip to conversation

xfsprogs: avoid array overflow in pf_batch_read()

PATCH In review Eric Sandeen 3 participants 3 messages Aug 30, 2013 – Oct 18, 2013

lore
Share & tools
lore

Eric Sandeen

author
#0 lore raw

PATCH 1/1 xfsprogs: avoid array overflow in pf_batch_read()

The while loop in pf_batch_read, and the code preceeding it, is really... quite a thing. I'd love to rewrite it, but I haven't yet found a particularly cleaner way.

It cleverly hides the fact that we might increment "num" past the last index of bplist[] and then assign to it. This corrupts memory.

Rather than major surgery for now, just go for the simple fix, and break out of the loop if we've increased "num" past the last index.

Signed-off-by Eric Sandeen <[email protected]>

---

repair/prefetch.c +2 -0
index 7529f5d..d3491da 100644
@@ -429,6 +429,8 @@ pf_batch_read(
 			if (which != PF_META_ONLY ||
 			    !B_IS_INODE(XFS_BUF_PRIORITY(bplist[num])))
 				num++;
+			if (num == MAX_BUFS)
+				break;
 			bplist[num] = btree_lookup_next(args->io_queue, &fsbno);
 		}
 		if (!num)

_______________________________________________
xfs mailing list
[email protected]
http://oss.sgi.com/mailman/listinfo/xfs

Reviewed-by on v1 1/1
#1 lore raw
Quoted 10 lines · Eric Sandeen

The while loop in pf_batch_read, and the code preceeding it, is really... quite a thing. I'd love to rewrite it, but I haven't yet found a particularly cleaner way.

It cleverly hides the fact that we might increment "num" past the last index of bplist[] and then assign to it. This corrupts memory.

Rather than major surgery for now, just go for the simple fix, and break out of the loop if we've increased "num" past the last index.

looks good.

Reviewed-by Dave Chinner <[email protected]>
Signature · 7 lines
Dave Chinner
[email protected]

_______________________________________________
xfs mailing list
[email protected]
http://oss.sgi.com/mailman/listinfo/xfs