diff options
| author | Ingo Molnar <mingo@elte.hu> | 2011-04-22 10:19:26 +0200 |
|---|---|---|
| committer | Ingo Molnar <mingo@elte.hu> | 2011-04-22 10:19:30 +0200 |
| commit | eff430de53be6f3328c3eebe93755f1ecf499e37 (patch) | |
| tree | c8e5ae958fe3e6656b4e96c83bbda17e649321a2 /fs/partitions/ldm.c | |
| parent | 9cbdb702092a2d82f909312f4ec3eeded77bb82e (diff) | |
| parent | 91e8549bde9e5cc88c5a2e8c8114389279e240b5 (diff) | |
Merge branch 'linus' into perf/core
Merge reason: Pick up upstream fixes.
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Diffstat (limited to 'fs/partitions/ldm.c')
| -rw-r--r-- | fs/partitions/ldm.c | 16 |
1 files changed, 12 insertions, 4 deletions
diff --git a/fs/partitions/ldm.c b/fs/partitions/ldm.c index b10e3540d5b..ce4f6244042 100644 --- a/fs/partitions/ldm.c +++ b/fs/partitions/ldm.c @@ -1299,6 +1299,11 @@ static bool ldm_frag_add (const u8 *data, int size, struct list_head *frags) BUG_ON (!data || !frags); + if (size < 2 * VBLK_SIZE_HEAD) { + ldm_error("Value of size is to small."); + return false; + } + group = get_unaligned_be32(data + 0x08); rec = get_unaligned_be16(data + 0x0C); num = get_unaligned_be16(data + 0x0E); @@ -1306,6 +1311,10 @@ static bool ldm_frag_add (const u8 *data, int size, struct list_head *frags) ldm_error ("A VBLK claims to have %d parts.", num); return false; } + if (rec >= num) { + ldm_error("REC value (%d) exceeds NUM value (%d)", rec, num); + return false; + } list_for_each (item, frags) { f = list_entry (item, struct frag, list); @@ -1334,10 +1343,9 @@ found: f->map |= (1 << rec); - if (num > 0) { - data += VBLK_SIZE_HEAD; - size -= VBLK_SIZE_HEAD; - } + data += VBLK_SIZE_HEAD; + size -= VBLK_SIZE_HEAD; + memcpy (f->data+rec*(size-VBLK_SIZE_HEAD)+VBLK_SIZE_HEAD, data, size); return true; |