From patchwork Thu Dec 13 22:04:22 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sami Liedes X-Patchwork-Id: 206262 Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 2013B2C009A for ; Fri, 14 Dec 2012 09:39:13 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754985Ab2LMWjL (ORCPT ); Thu, 13 Dec 2012 17:39:11 -0500 Received: from smtp-4.hut.fi ([130.233.228.94]:52319 "EHLO smtp-4.hut.fi" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753877Ab2LMWjK (ORCPT ); Thu, 13 Dec 2012 17:39:10 -0500 Received: from localhost (katosiko.hut.fi [130.233.228.115]) by smtp-4.hut.fi (8.13.6/8.12.10) with ESMTP id qBDM4dlk022307 for ; Fri, 14 Dec 2012 00:04:39 +0200 Received: from smtp-4.hut.fi ([130.233.228.94]) by localhost (katosiko.hut.fi [130.233.228.115]) (amavisd-new, port 10024) with LMTP id 03890-62 for ; Fri, 14 Dec 2012 00:04:39 +0200 (EET) Received: from kosh.localdomain (kosh.hut.fi [130.233.228.12]) by smtp-4.hut.fi (8.13.6/8.12.10) with ESMTP id qBDM4Njp022298 for ; Fri, 14 Dec 2012 00:04:23 +0200 Received: by kosh.localdomain (Postfix, from userid 43888) id 3E3194BA; Fri, 14 Dec 2012 00:04:23 +0200 (EET) Date: Fri, 14 Dec 2012 00:04:22 +0200 From: Sami Liedes To: linux-ext4@vger.kernel.org Subject: [PATCH 4/8] lib/ext2fs/block.c: Fix undefined behavior in block_iterate_tind() Message-ID: <20121213220422.GL9713@sli.dy.fi> Mail-Followup-To: linux-ext4@vger.kernel.org References: MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) X-TKK-Virus-Scanned: by amavisd-new-2.1.2-hutcc at katosiko.hut.fi Sender: linux-ext4-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-ext4@vger.kernel.org The intermediate result of limit*limit*limit is too big to fit in a 32-bit integer, causing undefined behavior. Fix by casting one of the limits to the result type of e2_blkcnt_t. Caught using clang -fsanitize=undefined. Signed-off-by: Sami Liedes --- lib/ext2fs/block.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/ext2fs/block.c b/lib/ext2fs/block.c index 68dcb03..dd3911d 100644 --- a/lib/ext2fs/block.c +++ b/lib/ext2fs/block.c @@ -251,7 +251,7 @@ static int block_iterate_tind(blk_t *tind_block, blk_t ref_block, } check_for_ro_violation_return(ctx, ret); if (!*tind_block || (ret & BLOCK_ABORT)) { - ctx->bcount += limit*limit*limit; + ctx->bcount += ((e2_blkcnt_t)limit)*limit*limit; return ret; } if (*tind_block >= ext2fs_blocks_count(ctx->fs->super) ||