diff options
| author | Zach Brown <zab@redhat.com> | 2013-10-07 14:42:56 -0700 |
|---|---|---|
| committer | Chris Mason <chris.mason@fusionio.com> | 2013-10-16 08:23:13 -0400 |
| commit | 961eaa7d3975928635e3dc775e6ab3a2f36a5303 (patch) | |
| tree | 00d8fc5a023201daa6ceb69023f57f3755d15301 /btrfs-image.c | |
| parent | 91f5f22d7d00077b797a99b74f682abdb1b7323d (diff) | |
| download | btrfs-progs-961eaa7d3975928635e3dc775e6ab3a2f36a5303.tar.gz | |
btrfs-progs: don't overrun name in find-collisions
find_collision() allocates name_len bytes for its sub array so the index
must be less than name_len. This was found by static analysis.
Signed-off-by: Zach Brown <zab@redhat.com>
Signed-off-by: David Sterba <dsterba@suse.cz>
Signed-off-by: Chris Mason <chris.mason@fusionio.com>
Diffstat (limited to 'btrfs-image.c')
| -rw-r--r-- | btrfs-image.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/btrfs-image.c b/btrfs-image.c index 189e546..52209a7 100644 --- a/btrfs-image.c +++ b/btrfs-image.c @@ -314,11 +314,11 @@ static char *find_collision(struct metadump_struct *md, char *name, if (val->sub[i] == 127) { do { i++; - if (i > name_len) + if (i >= name_len) break; } while (val->sub[i] == 127); - if (i > name_len) + if (i >= name_len) break; val->sub[i]++; if (val->sub[i] == '/') |