linux-kernel - Re: fs/ufs/inode.c:817: warning: array subscript is above array bounds

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20070201205557.GA14227@rain>
Date:	Thu, 1 Feb 2007 23:55:57 +0300
From:	Evgeniy Dushistov <dushistov@...l.ru>
To:	Andrew Morton <akpm@...l.org>
Cc:	Tomasz Kvarsin <kvarsin@...il.com>, dcb314@...mail.com,
	linux-kernel@...r.kernel.org
Subject: Re: fs/ufs/inode.c:817: warning: array subscript is above array bounds

On Wed, Jan 31, 2007 at 01:24:32PM -0800, Andrew Morton wrote:
> On Wed, 31 Jan 2007 23:10:57 +0300
> "Tomasz Kvarsin" <kvarsin@...il.com> wrote:
> 
> > d binderman wrote:
> > >Hello there,
> > >
> > >I just tried to compile Linux kernel 2.6.19.2 with the
> > >new GNU C compiler version 4.3 snapshot 20070126.
> > >
> > >The compiler said
> > >
> > >fs/ufs/inode.c:817: warning: array subscript is above array bounds
> > >
> > >The source code is
> > >
> > >        for (i = 0; i < (UFS_NDADDR + UFS_NINDIR); i++)
> > >            ufs_inode->ui_u2.ui_addr.ui_db[i] = ufsi->i_u1.i_data[i];
> > >
> > >but
> > >
> > >./include/linux/ufs_fs.h:                       __fs32  ui_db[UFS_NDADDR];/*
> > >0x28 data blocks */
> > >./include/linux/ufs_fs.h:                       __fs64
> > >ui_db[UFS_NDADDR]; /* 112: Direct disk blocks. */
> > >
> > >and
> > >
> > >        __fs32  i_data[15];
> > >
> > >and
> > >
> > >#define UFS_NDADDR 12
> > >#define UFS_NINDIR 3
> > >
> > >so the kernel seems to be trying to write fifteen bytes into an array only
> > >twelve
> > >bytes in size. Suggest code rework.

Actually, this is not a _real_ bug,
yes, 
for (i = 0; i < (UFS_NDADDR + UFS_NINDIR); i++)
	ufs_inode->ui_u2.ui_addr.ui_db[i]

and ui_db only ui_db[UFS_NDADDR], but if look on more high level,
then:
union {
struct {
     __fs64     ui_db[UFS_NDADDR]; /* 112: Direct disk blocks. */
      __fs64     ui_ib[UFS_NINDIR];/* 208: Indirect disk blocks.*/
} ui_addr;
} ui_u2;

have no idea, why array splited on two parts,
may be some macros used this feature.

-- 
/Evgeniy

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/