diff options
author | Christoph Hellwig <hch@infradead.org> | 2011-05-11 11:04:11 -0400 |
---|---|---|
committer | Alex Elder <aelder@sgi.com> | 2011-05-25 11:48:37 -0400 |
commit | 87bef1812d337beadfb1099e7361fd41264eb88e (patch) | |
tree | 707b3c2a623b4fc80ce790bb61bd5262d9396821 | |
parent | ab1908a5bb21a8eebf16e5d92d087fd9413cf67d (diff) |
xfs: check for valid indices in xfs_iext_get_ext and xfs_iext_idx_to_irec
Based on an earlier patch from Lachlan McIlroy.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Lachlan McIlroy <lmcilroy@redhat.com>
Signed-off-by: Alex Elder <aelder@sgi.com>
-rw-r--r-- | fs/xfs/xfs_inode.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c index 6f318eeac401..b71a907e15ab 100644 --- a/fs/xfs/xfs_inode.c +++ b/fs/xfs/xfs_inode.c | |||
@@ -3108,6 +3108,8 @@ xfs_iext_get_ext( | |||
3108 | xfs_extnum_t idx) /* index of target extent */ | 3108 | xfs_extnum_t idx) /* index of target extent */ |
3109 | { | 3109 | { |
3110 | ASSERT(idx >= 0); | 3110 | ASSERT(idx >= 0); |
3111 | ASSERT(idx < ifp->if_bytes / sizeof(xfs_bmbt_rec_t)); | ||
3112 | |||
3111 | if ((ifp->if_flags & XFS_IFEXTIREC) && (idx == 0)) { | 3113 | if ((ifp->if_flags & XFS_IFEXTIREC) && (idx == 0)) { |
3112 | return ifp->if_u1.if_ext_irec->er_extbuf; | 3114 | return ifp->if_u1.if_ext_irec->er_extbuf; |
3113 | } else if (ifp->if_flags & XFS_IFEXTIREC) { | 3115 | } else if (ifp->if_flags & XFS_IFEXTIREC) { |
@@ -3881,8 +3883,10 @@ xfs_iext_idx_to_irec( | |||
3881 | xfs_extnum_t page_idx = *idxp; /* extent index in target list */ | 3883 | xfs_extnum_t page_idx = *idxp; /* extent index in target list */ |
3882 | 3884 | ||
3883 | ASSERT(ifp->if_flags & XFS_IFEXTIREC); | 3885 | ASSERT(ifp->if_flags & XFS_IFEXTIREC); |
3884 | ASSERT(page_idx >= 0 && page_idx <= | 3886 | ASSERT(page_idx >= 0); |
3885 | ifp->if_bytes / (uint)sizeof(xfs_bmbt_rec_t)); | 3887 | ASSERT(page_idx <= ifp->if_bytes / sizeof(xfs_bmbt_rec_t)); |
3888 | ASSERT(page_idx < ifp->if_bytes / sizeof(xfs_bmbt_rec_t) || realloc); | ||
3889 | |||
3886 | nlists = ifp->if_real_bytes / XFS_IEXT_BUFSZ; | 3890 | nlists = ifp->if_real_bytes / XFS_IEXT_BUFSZ; |
3887 | erp_idx = 0; | 3891 | erp_idx = 0; |
3888 | low = 0; | 3892 | low = 0; |