Whamcloud - gitweb
libext2fs: fix bounds check of the bitmap test range in get_free_blocks2
authorDarrick J. Wong <darrick.wong@oracle.com>
Fri, 25 Jul 2014 11:11:57 +0000 (07:11 -0400)
committerTheodore Ts'o <tytso@mit.edu>
Fri, 25 Jul 2014 11:11:57 +0000 (07:11 -0400)
commit203e13cf9cf0754efd1e322885b2099fa43cb3fa
tree7a2a96ffa8eb7c645e7641d381ba204407fc9ff6
parentb4f724c8a90987d4785fd1accfe69c125567be39
libext2fs: fix bounds check of the bitmap test range in get_free_blocks2

In the loop in ext2fs_get_free_blocks2, we ask the bitmap if there's a
range of free blocks starting at "b" and ending at "b + num - 1".
That quantity is the number of the last block in the range.  Since
ext2fs_blocks_count() returns the number of blocks and not the number
of the last block in the filesystem, the check is incorrect.

Put in a shortcut to exit the loop if finish > start, because in that
case it's obvious that we don't need to reset to the beginning of the
FS to continue the search for blocks.  This is needed to terminate the
loop because the broken test meant that b could get large enough to
equal finish, which would end the while loop.

The attached testcase shows that with the off by one error, it is
possible to throw e2fsck into an infinite loop while it tries to
find space for the inode table even though there's no space for one.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
lib/ext2fs/alloc.c
tests/f_boundscheck/expect.1 [new file with mode: 0644]
tests/f_boundscheck/expect.2 [new file with mode: 0644]
tests/f_boundscheck/image.bz2 [new file with mode: 0644]
tests/f_boundscheck/name [new file with mode: 0644]
tests/f_boundscheck/script [new file with mode: 0755]