From patchwork Sun Mar 1 20:35:28 2009 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: roel kluin X-Patchwork-Id: 23915 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from bombadil.infradead.org (bombadil.infradead.org [18.85.46.34]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by ozlabs.org (Postfix) with ESMTPS id 5E581DDE11 for ; Mon, 2 Mar 2009 07:37:36 +1100 (EST) Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.69 #1 (Red Hat Linux)) id 1LdsO1-0000Ln-Sr; Sun, 01 Mar 2009 20:35:45 +0000 Received: from mail-ew0-f172.google.com ([209.85.219.172]) by bombadil.infradead.org with esmtp (Exim 4.69 #1 (Red Hat Linux)) id 1LdsNl-0000La-I6 for linux-mtd@lists.infradead.org; Sun, 01 Mar 2009 20:35:44 +0000 Received: by ewy20 with SMTP id 20so2117938ewy.18 for ; Sun, 01 Mar 2009 12:35:27 -0800 (PST) Received: by 10.210.57.12 with SMTP id f12mr2572045eba.51.1235939727450; Sun, 01 Mar 2009 12:35:27 -0800 (PST) Received: from ?192.168.1.115? (d133062.upc-d.chello.nl [213.46.133.62]) by mx.google.com with ESMTPS id 10sm1250742eyz.10.2009.03.01.12.35.26 (version=TLSv1/SSLv3 cipher=RC4-MD5); Sun, 01 Mar 2009 12:35:26 -0800 (PST) Message-ID: <49AAF190.6050404@gmail.com> Date: Sun, 01 Mar 2009 21:35:28 +0100 From: Roel Kluin User-Agent: Thunderbird 2.0.0.18 (X11/20081105) MIME-Version: 1.0 To: dwmw2@infradead.org Subject: [PATCH] jffs2_acl_count() tests < 0 on unsigned X-Spam-Score: 0.0 (/) Cc: Andrew Morton , linux-mtd@lists.infradead.org X-BeenThere: linux-mtd@lists.infradead.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Linux MTD discussion mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-mtd-bounces@lists.infradead.org Errors-To: linux-mtd-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org This patch wasn't tested in any way. ------------------------------>8-------------8<--------------------------------- size_t s is unsigned and cannot be less than 0. Signed-off-by: Roel Kluin diff --git a/fs/jffs2/acl.c b/fs/jffs2/acl.c index d987137..6e63e8b 100644 --- a/fs/jffs2/acl.c +++ b/fs/jffs2/acl.c @@ -38,12 +38,12 @@ static int jffs2_acl_count(size_t size) size_t s; size -= sizeof(struct jffs2_acl_header); - s = size - 4 * sizeof(struct jffs2_acl_entry_short); - if (s < 0) { + if (size < 4 * sizeof(struct jffs2_acl_entry_short)) { if (size % sizeof(struct jffs2_acl_entry_short)) return -1; return size / sizeof(struct jffs2_acl_entry_short); } else { + s = size - 4 * sizeof(struct jffs2_acl_entry_short); if (s % sizeof(struct jffs2_acl_entry)) return -1; return s / sizeof(struct jffs2_acl_entry) + 4;