Expression if (size != (ssize_t)size) is always false.
Therefore no bounds check errors detected.
Signed-off-by: Dmitry Eremin <dmitry.eremin@intel.com>
Change-Id: Ib8fc68b2ddbb50ad50d80aa391c9bed6308ea575
Reviewed-on: http://review.whamcloud.com/11376
Tested-by: Jenkins
Tested-by: Maloo <hpdd-maloo@intel.com>
Reviewed-by: John L. Hammond <john.hammond@intel.com>
Reviewed-by: Fan Yong <fan.yong@intel.com>
Reviewed-by: Oleg Drokin <oleg.drokin@intel.com>
(__u64)hur->hur_request.hr_itemcount *
sizeof(hur->hur_user_item[0]) + hur->hur_request.hr_data_len;
- if (size != (ssize_t)size)
+ if (size > ~((size_t)0)>>1)
return -1;
return size;