The intermediate result of limit*limit*limit is too big to fit in a
32-bit integer, causing undefined behavior. Fix by casting one of the
limits to the result type of e2_blkcnt_t.
Caught using clang -fsanitize=undefined.
Signed-off-by: Sami Liedes <sami.liedes@xxxxxx>
---
lib/ext2fs/block.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/lib/ext2fs/block.c b/lib/ext2fs/block.c
index 68dcb03..dd3911d 100644
--- a/lib/ext2fs/block.c
+++ b/lib/ext2fs/block.c
@@ -251,7 +251,7 @@ static int block_iterate_tind(blk_t *tind_block, blk_t ref_block,
}
check_for_ro_violation_return(ctx, ret);
if (!*tind_block || (ret & BLOCK_ABORT)) {
- ctx->bcount += limit*limit*limit;
+ ctx->bcount += ((e2_blkcnt_t)limit)*limit*limit;
return ret;
}
if (*tind_block >= ext2fs_blocks_count(ctx->fs->super) ||
--
1.7.10.4
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
