DragonFlyBSD Kernel Audit
DF-0821 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/vfs/hammer2/hammer2_freemap.c b/sys/vfs/hammer2/hammer2_freemap.c
--- a/sys/vfs/hammer2/hammer2_freemap.c
+++ b/sys/vfs/hammer2/hammer2_freemap.c
@@ -613,10 +613,10 @@
 	 * NOTE: TODO this can leave little unallocatable fragments lying
 	 *	 around.
 	 */
-	if (((uint32_t)bmap->linear & HAMMER2_FREEMAP_BLOCK_MASK) + size <=
+	if (bmap->linear >= 0 && bmap->linear < HAMMER2_SEGSIZE &&
+	    ((uint32_t)bmap->linear & HAMMER2_FREEMAP_BLOCK_MASK) + size <=
 	    HAMMER2_FREEMAP_BLOCK_SIZE &&
-	    (bmap->linear & HAMMER2_FREEMAP_BLOCK_MASK) &&
-	    bmap->linear < HAMMER2_SEGSIZE) {
+	    (bmap->linear & HAMMER2_FREEMAP_BLOCK_MASK)) {
 		/*
 		 * Use linear iterator if it is not block-aligned to avoid
 		 * wasting space.