diff options
| author | Alasdair G Kergon <agk@redhat.com> | 2018-01-10 02:03:32 +0000 |
|---|---|---|
| committer | Alasdair G Kergon <agk@redhat.com> | 2018-01-10 15:48:03 +0000 |
| commit | bacc94233368cf136b55e2574e969e7f53b31c6c (patch) | |
| tree | dec7d63cc665113afca31091c49f7dab4b65ccbe | |
| parent | e2438b5b9ff526cae8fa29ca7023b43995f00647 (diff) | |
| download | lvm2-bacc94233368cf136b55e2574e969e7f53b31c6c.tar.gz | |
allocation: Avoid exceeding array bounds in allocation tag code
If _limit_to_one_area_per_tag() changes nothing it writes beyond
the array.
| -rw-r--r-- | WHATS_NEW | 1 | ||||
| -rw-r--r-- | lib/metadata/lv_manip.c | 3 |
2 files changed, 3 insertions, 1 deletions
@@ -1,5 +1,6 @@ Version 2.02.178 - ===================================== + Avoid exceeding array bounds in allocation tag processing. Refactor metadata reading code to use callback functions. Move memory allocation for the key dev_reads into the device layer. diff --git a/lib/metadata/lv_manip.c b/lib/metadata/lv_manip.c index 70dc2d92c..ac30dadeb 100644 --- a/lib/metadata/lv_manip.c +++ b/lib/metadata/lv_manip.c @@ -2737,7 +2737,8 @@ static int _limit_to_one_area_per_tag(struct alloc_handle *ah, struct alloc_stat s++; } - alloc_state->areas[u].pva = NULL; + if (u < alloc_state->areas_size) + alloc_state->areas[u].pva = NULL; return 1; } |