Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
tjh.dev
kernel
os
linux
udf: potential integer overflow
bloc->logicalBlockNum is unsigned so it's never less than zero.
When I saw that, it made me worry that "bloc->logicalBlockNum + count"
could overflow. That's why I changed the check for less than zero
to an overflow check. (The test works because "count" is also
unsigned.)
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
authored by Dan Carpenter and committed by Jan Kara 69ecbbed 0fdf8675
+4
-6
fs/udf/balloc.c
+4
-6
fs/udf/balloc.c
···
125
125
126
126
mutex_lock(&sbi->s_alloc_mutex);
127
127
partmap = &sbi->s_partmaps[bloc->partitionReferenceNum];
128
-
if (bloc->logicalBlockNum < 0 ||
129
-
(bloc->logicalBlockNum + count) >
130
-
partmap->s_partition_len) {
128
+
if (bloc->logicalBlockNum + count < count ||
129
+
(bloc->logicalBlockNum + count) > partmap->s_partition_len) {
131
130
udf_debug("%d < %d || %d + %d > %d\n",
132
131
bloc->logicalBlockNum, 0, bloc->logicalBlockNum,
133
132
count, partmap->s_partition_len);
···
392
393
393
394
mutex_lock(&sbi->s_alloc_mutex);
394
395
partmap = &sbi->s_partmaps[bloc->partitionReferenceNum];
395
-
if (bloc->logicalBlockNum < 0 ||
396
-
(bloc->logicalBlockNum + count) >
397
-
partmap->s_partition_len) {
396
+
if (bloc->logicalBlockNum + count < count ||
397
+
(bloc->logicalBlockNum + count) > partmap->s_partition_len) {
398
398
udf_debug("%d < %d || %d + %d > %d\n",
399
399
bloc->logicalBlockNum, 0, bloc->logicalBlockNum, count,
400
400
partmap->s_partition_len);