From 17de65420dbc114001896d243fbb27cc3ba6bf61 Mon Sep 17 00:00:00 2001 From: Ken Sumrall Date: Thu, 15 Aug 2013 19:06:29 -0700 Subject: Avoid underflow on an unsigned int when computering bg overrun A computation for when a block group overruns the end of an image was consistently storing a negative number in an unsigned var, and then checking for >0, which is always true for negative numbers. So first check if the number will be positive before computing it. Change-Id: Ic8cff8f9ab9f4ea8c5a4dc42143c2430fa87ba12 --- ext4_utils/allocate.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/ext4_utils/allocate.c b/ext4_utils/allocate.c index 5c60e924..c0b2c7eb 100644 --- a/ext4_utils/allocate.c +++ b/ext4_utils/allocate.c @@ -312,9 +312,10 @@ static void init_bg(struct block_group_info *bg, unsigned int i) if (reserve_blocks(bg, bg->first_free_block, bg->header_blocks) < 0) error("failed to reserve %u blocks in block group %u\n", bg->header_blocks, i); - u32 overrun = bg->first_block + info.blocks_per_group - aux_info.len_blocks; - if (overrun > 0) + if (bg->first_block + info.blocks_per_group > aux_info.len_blocks) { + u32 overrun = bg->first_block + info.blocks_per_group - aux_info.len_blocks; reserve_blocks(bg, info.blocks_per_group - overrun, overrun); + } } void block_allocator_init() -- cgit v1.2.3