|
 |
393826 |
From b989de221a8399d42aede6da03297cad3330f12a Mon Sep 17 00:00:00 2001
|
|
|
393826 |
From: Theodore Ts'o <tytso@mit.edu>
|
|
|
393826 |
Date: Mon, 4 Nov 2019 16:43:41 -0500
|
|
|
393826 |
Subject: [PATCH 01/10] libext2fs: fix bug when reading or writing more than
|
|
|
393826 |
2GB in unix_io
|
|
|
393826 |
|
|
|
393826 |
If count * block_size exceeds 2GB, we will overflow a 32-bit signed
|
|
|
393826 |
integer value. This shouldn't happen in practice except for
|
|
|
393826 |
fuzz-corrupted file systems, but let's fix the code so it's correct.
|
|
|
393826 |
|
|
|
393826 |
Bug: https://github.com/tytso/e2fsprogs/issues/24
|
|
|
393826 |
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
|
|
|
393826 |
---
|
|
|
393826 |
lib/ext2fs/unix_io.c | 4 ++--
|
|
|
393826 |
1 file changed, 2 insertions(+), 2 deletions(-)
|
|
|
393826 |
|
|
|
393826 |
diff --git a/lib/ext2fs/unix_io.c b/lib/ext2fs/unix_io.c
|
|
|
393826 |
index 74fc8a75..628e60c3 100644
|
|
|
393826 |
--- a/lib/ext2fs/unix_io.c
|
|
|
393826 |
+++ b/lib/ext2fs/unix_io.c
|
|
|
393826 |
@@ -166,7 +166,7 @@ static errcode_t raw_read_blk(io_channel channel,
|
|
|
393826 |
unsigned char *buf = bufv;
|
|
|
393826 |
ssize_t really_read = 0;
|
|
|
393826 |
|
|
|
393826 |
- size = (count < 0) ? -count : count * channel->block_size;
|
|
|
393826 |
+ size = (count < 0) ? -count : (ext2_loff_t) count * channel->block_size;
|
|
|
393826 |
data->io_stats.bytes_read += size;
|
|
|
393826 |
location = ((ext2_loff_t) block * channel->block_size) + data->offset;
|
|
|
393826 |
|
|
|
393826 |
@@ -275,7 +275,7 @@ static errcode_t raw_write_blk(io_channel channel,
|
|
|
393826 |
if (count < 0)
|
|
|
393826 |
size = -count;
|
|
|
393826 |
else
|
|
|
393826 |
- size = count * channel->block_size;
|
|
|
393826 |
+ size = (ext2_loff_t) count * channel->block_size;
|
|
|
393826 |
}
|
|
|
393826 |
data->io_stats.bytes_written += size;
|
|
|
393826 |
|
|
|
393826 |
--
|
|
|
393826 |
2.21.1
|
|
|
393826 |
|