summaryrefslogtreecommitdiff
path: root/fs
diff options
context:
space:
mode:
authorStefan Brüns <stefan.bruens@rwth-aachen.de>2016-09-06 04:36:50 +0200
committerTom Rini <trini@konsulko.com>2016-09-23 09:02:40 -0400
commit0ceef3d3710960347fde6c57f12f3de6fe9cfaaf (patch)
tree72cac3cf807debecfaffe262c6d6994667a88edd /fs
parenta9fa0ed183b7e156db0c711f2aad8d573fae3498 (diff)
downloadu-boot-0ceef3d3710960347fde6c57f12f3de6fe9cfaaf.tar.gz
ext4: Avoid out-of-bounds access of block bitmap
If the blocksize is 1024, count is initialized with 1. Incrementing count by 8 will never match (count == fs->blksz * 8), and ptr may be incremented beyond the buffer end if the bitmap is filled. Add the startblock offset after the loop. Remove the second loop, as only the first iteration will be done. Signed-off-by: Stefan Brüns <stefan.bruens@rwth-aachen.de> Reviewed-by: Lukasz Majewski <l.majewski@samsung.com>
Diffstat (limited to 'fs')
-rw-r--r--fs/ext4/ext4_common.c34
1 files changed, 12 insertions, 22 deletions
diff --git a/fs/ext4/ext4_common.c b/fs/ext4/ext4_common.c
index db5cdb9c06..5e874afc70 100644
--- a/fs/ext4/ext4_common.c
+++ b/fs/ext4/ext4_common.c
@@ -163,18 +163,12 @@ static int _get_new_inode_no(unsigned char *buffer)
static int _get_new_blk_no(unsigned char *buffer)
{
- unsigned char input;
- int operand, status;
+ int operand;
int count = 0;
- int j = 0;
+ int i;
unsigned char *ptr = buffer;
struct ext_filesystem *fs = get_fs();
- if (fs->blksz != 1024)
- count = 0;
- else
- count = 1;
-
while (*ptr == 255) {
ptr++;
count += 8;
@@ -182,21 +176,17 @@ static int _get_new_blk_no(unsigned char *buffer)
return -1;
}
- for (j = 0; j < fs->blksz; j++) {
- input = *ptr;
- int i = 0;
- while (i <= 7) {
- operand = 1 << i;
- status = input & operand;
- if (status) {
- i++;
- count++;
- } else {
- *ptr |= operand;
- return count;
- }
+ if (fs->blksz == 1024)
+ count += 1;
+
+ for (i = 0; i <= 7; i++) {
+ operand = 1 << i;
+ if (*ptr & operand) {
+ count++;
+ } else {
+ *ptr |= operand;
+ return count;
}
- ptr = ptr + 1;
}
return -1;