Skip to contentSkip to conversation

ide-cd: unsigned len subtracted below 0?

PATCH In review Roel Kluin 2 participants 2 messages Mar 3, 2009 – Mar 4, 2009 libata

lore
Share & tools
lore

Roel Kluin

author
#0 lore raw

PATCH 1/1 ide-cd: unsigned len subtracted below 0?

len is unsigned, so take care not to subtract below 0.

Signed-off-by Roel Kluin <[email protected]>

---

drivers/ide/ide-cd.c +4 -1
index ddfbea4..23447a0 100644
@@ -916,7 +916,10 @@ static ide_startstop_t cdrom_newpc_intr(ide_drive_t *drive)
 		xferfunc(drive, NULL, ptr, blen);
 
 		thislen -= blen;
-		len -= blen;
+		if (blen > len)
+			len -= blen;
+		else
+			len = 0;
 
 		if (blk_fs_request(rq)) {
 			rq->buffer += blen;
#1 lore raw
Quoted 9 lines · Roel Kluin

len is unsigned, so take care not to subtract below 0.

Signed-off-by Roel Kluin <[email protected]>

---

drivers/ide/ide-cd.c +0 -0
index ddfbea4..23447a0 100644

drivers/ide/ide-cd.c static ide_startstop_t cdrom_newpc_intr(ide_drive_t *drive) · line 922

Quoted 8 lines
drivers/ide/ide-cd.c +4 -1
@@ -916,7 +916,10 @@ static ide_startstop_t cdrom_newpc_intr(ide_drive_t *drive)
 		xferfunc(drive, NULL, ptr, blen);
 
 		thislen -= blen;
-		len -= blen;
+		if (blen > len)
+			len -= blen;
+		else
+			len = 0;

Hi,

can you please look at the code and try to understand what it does. Especially the part where thislen is being initialized:

        thislen = blk_fs_request(rq) ? len : cmd->nleft;
        if (thislen > len)
                thislen = len;

now look at the loop where len is being decremented. Question: can len really wrap?

Quoted 3 lines
drivers/ide/ide-cd.c +0 -0
 		if (blk_fs_request(rq)) {
 			rq->buffer += blen;