DragonFlyBSD Kernel Audit
DF-3062 / fix.diff
← back to finding ↓ download raw
--- sys/vfs/ext2fs/ext2_alloc.c
+++ sys/vfs/ext2fs/ext2_alloc.c
@@ -1315,10 +1315,13 @@
 	if (EXT2_HAS_RO_COMPAT_FEATURE(fs, EXT2F_ROCOMPAT_GDT_CSUM) ||
 	    EXT2_HAS_RO_COMPAT_FEATURE(fs, EXT2F_ROCOMPAT_METADATA_CKSUM)) {
 		if (le16toh(fs->e2fs_gd[cg].ext4bgd_flags) &
 		    EXT2_BG_INODE_UNINIT) {
-			ibytes = fs->e2fs_ipg / 8;
-			memset(bp->b_data, 0, ibytes - 1);
+			/* DF-3062: ipg/8 == 0 for mount-legal ipg < 8, so
+			 * ibytes - 1 underflows size_t and memset() runs to
+			 * SIZE_MAX.  Use the rounded-up byte count. */
+			ibytes = howmany(fs->e2fs_ipg, NBBY);
+			memset(bp->b_data, 0, ibytes);
 			ext2_fix_bitmap_tail(bp->b_data, ibytes,
 			    fs->e2fs_bsize - 1);
 			fs->e2fs_gd[cg].ext4bgd_flags = htole16(le16toh(
 			    fs->e2fs_gd[cg].ext4bgd_flags) &