diff options
| author | Eric Sandeen <esandeen@redhat.com> | 2006-08-30 02:16:55 -0400 |
|---|---|---|
| committer | Theodore Ts'o <tytso@mit.edu> | 2006-08-30 02:16:55 -0400 |
| commit | 5830d6be9c33e23bb20c339036083e6e4fa6795e (patch) | |
| tree | e896bdb9499e533e0a89d11d7f652ab4bd32ffea /e2fsck/pass5.c | |
| parent | 57d7bb7b087d93d67623e260c1380afed1665e24 (diff) | |
| download | e2fsprogs-5830d6be9c33e23bb20c339036083e6e4fa6795e.tar.gz | |
Detect overflows in loop counters
For loops such as:
for (i=1; i <= fs->super->s_blocks_count; i++) {
<do_stuff>
}
if i is an int and s_blocks_count is (2^32-1), the condition is never false.
Change these loops to:
for (i=1; i <= fs->super->s_blocks_count && i > 0; i++) {
<do_stuff>
}
to stop the loop when we overflow i
Signed-off-by: Eric Sandeen <esandeen@redhat.com>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Diffstat (limited to 'e2fsck/pass5.c')
| -rw-r--r-- | e2fsck/pass5.c | 13 |
1 files changed, 8 insertions, 5 deletions
diff --git a/e2fsck/pass5.c b/e2fsck/pass5.c index eb3ebf02..7467854d 100644 --- a/e2fsck/pass5.c +++ b/e2fsck/pass5.c @@ -370,7 +370,8 @@ redo_counts: EXT2_BG_INODE_UNINIT)) skip_group++; - for (i = 1; i <= fs->super->s_inodes_count; i++) { + /* Protect loop from wrap-around if inodes_count is maxed */ + for (i = 1; i <= fs->super->s_inodes_count && i > 0; i++) { actual = ext2fs_fast_test_inode_bitmap(ctx->inode_used_map, i); if (skip_group) bitmap = 0; @@ -528,8 +529,9 @@ static void check_inode_end(e2fsck_t ctx) } if (save_inodes_count == end) return; - - for (i = save_inodes_count + 1; i <= end; i++) { + + /* protect loop from wrap-around if end is maxed */ + for (i = save_inodes_count + 1; i <= end && i > save_inodes_count; i++) { if (!ext2fs_test_inode_bitmap(fs->inode_map, i)) { if (fix_problem(ctx, PR_5_INODE_BMAP_PADDING, &pctx)) { for (i = save_inodes_count + 1; i <= end; i++) @@ -572,8 +574,9 @@ static void check_block_end(e2fsck_t ctx) } if (save_blocks_count == end) return; - - for (i = save_blocks_count + 1; i <= end; i++) { + + /* Protect loop from wrap-around if end is maxed */ + for (i = save_blocks_count + 1; i <= end && i > save_blocks_count; i++) { if (!ext2fs_test_block_bitmap(fs->block_map, i)) { if (fix_problem(ctx, PR_5_BLOCK_BMAP_PADDING, &pctx)) { for (i = save_blocks_count + 1; i <= end; i++) |