⬢ DragonFlyBSD Kernel Audit
DF-0811 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
diff --git a/sys/vfs/ext2fs/ext2_alloc.c b/sys/vfs/ext2fs/ext2_alloc.c
--- a/sys/vfs/ext2fs/ext2_alloc.c
+++ b/sys/vfs/ext2fs/ext2_alloc.c
@@ -857,7 +857,7 @@
 {
 
 	return ((block - le32toh(fs->e2fs->e2fs_first_dblock)) /
-	    fs->e2fs_bsize);
+	    fs->e2fs_bpg);
 }
 
 static int
@@ -890,21 +890,24 @@
 
 	/* Set bits for block and inode bitmaps, and inode table. */
 	tmp = e2fs_gd_get_b_bitmap(&fs->e2fs_gd[cg]);
-	if (!EXT2_HAS_INCOMPAT_FEATURE(fs, EXT2F_INCOMPAT_FLEX_BG) ||
-	    ext2_block_in_group(fs, tmp, cg))
+	if ((!EXT2_HAS_INCOMPAT_FEATURE(fs, EXT2F_INCOMPAT_FLEX_BG) ||
+	    ext2_block_in_group(fs, tmp, cg)) && tmp >= start &&
+	    tmp - start < (uint64_t)fs->e2fs_bsize * NBBY)
 		setbit(bp->b_data, tmp - start);
 
 	tmp = e2fs_gd_get_i_bitmap(&fs->e2fs_gd[cg]);
-	if (!EXT2_HAS_INCOMPAT_FEATURE(fs, EXT2F_INCOMPAT_FLEX_BG) ||
-	    ext2_block_in_group(fs, tmp, cg))
+	if ((!EXT2_HAS_INCOMPAT_FEATURE(fs, EXT2F_INCOMPAT_FLEX_BG) ||
+	    ext2_block_in_group(fs, tmp, cg)) && tmp >= start &&
+	    tmp - start < (uint64_t)fs->e2fs_bsize * NBBY)
 		setbit(bp->b_data, tmp - start);
 
 	tmp = e2fs_gd_get_i_tables(&fs->e2fs_gd[cg]);
 	inodes_per_block = fs->e2fs_bsize/EXT2_INODE_SIZE(fs);
 	while( tmp < e2fs_gd_get_i_tables(&fs->e2fs_gd[cg]) +
 	    fs->e2fs_ipg / inodes_per_block ) {
-		if (!EXT2_HAS_INCOMPAT_FEATURE(fs, EXT2F_INCOMPAT_FLEX_BG) ||
-		    ext2_block_in_group(fs, tmp, cg))
+		if ((!EXT2_HAS_INCOMPAT_FEATURE(fs, EXT2F_INCOMPAT_FLEX_BG) ||
+		    ext2_block_in_group(fs, tmp, cg)) && tmp >= start &&
+		    tmp - start < (uint64_t)fs->e2fs_bsize * NBBY)
 			setbit(bp->b_data, tmp - start);
 		tmp++;
 	}