linux-fsdevel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Colin King <colin.king@canonical.com>
To: linux-fsdevel@vger.kernel.org, dhowells@redhat.com,
	viro@zeniv.linux.org.uk
Cc: kernel-janitors@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH] hfs: fix array out of bounds read of array extent
Date: Fri, 31 Aug 2018 15:05:38 +0100	[thread overview]
Message-ID: <20180831140538.31566-1-colin.king@canonical.com> (raw)

From: Colin Ian King <colin.king@canonical.com>

Currently extent and index i are both being incremented causing
an array out of bounds read on extent[i]. Fix this by removing
the extraneous increment of extent.

Detected by CoverityScan, CID#711541 ("Out of bounds read")

Fixes: d1081202f1d0 ("HFS rewrite")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
---
 fs/hfs/extent.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/hfs/extent.c b/fs/hfs/extent.c
index 5d0182654580..636cdfcecb26 100644
--- a/fs/hfs/extent.c
+++ b/fs/hfs/extent.c
@@ -300,7 +300,7 @@ int hfs_free_fork(struct super_block *sb, struct hfs_cat_file *file, int type)
 		return 0;
 
 	blocks = 0;
-	for (i = 0; i < 3; extent++, i++)
+	for (i = 0; i < 3; i++)
 		blocks += be16_to_cpu(extent[i].count);
 
 	res = hfs_free_extents(sb, extent, blocks, blocks);
-- 
2.17.1

             reply	other threads:[~2018-08-31 18:13 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-08-31 14:05 Colin King [this message]
2018-10-17 17:49 ` [PATCH] hfs: fix array out of bounds read of array extent Ernesto A. Fernández
     [not found] ` <20181017150117.fef4f8d8e814aa2d25adba5e@linux-foundation.org>
2018-10-17 23:17   ` Al Viro
2018-10-17 23:28   ` Ernesto A. Fernández
2018-10-17 23:36   ` Viacheslav Dubeyko

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20180831140538.31566-1-colin.king@canonical.com \
    --to=colin.king@canonical.com \
    --cc=dhowells@redhat.com \
    --cc=kernel-janitors@vger.kernel.org \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=viro@zeniv.linux.org.uk \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).