Date: Tue, 24 Mar 2009 00:35:31 GMT From: Matthew Fleming <mfleming@isilon.com> To: freebsd-gnats-submit@FreeBSD.org Subject: misc/132987: unionfs_readdir has math problem Message-ID: <200903240035.n2O0ZVrr055991@www.freebsd.org> Resent-Message-ID: <200903240040.n2O0e68U016803@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 132987
>Category: misc
>Synopsis: unionfs_readdir has math problem
>Confidential: no
>Severity: non-critical
>Priority: medium
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Tue Mar 24 00:40:05 UTC 2009
>Closed-Date:
>Last-Modified:
>Originator: Matthew Fleming
>Release: RELENG 7.1
>Organization:
Isilon Systems
>Environment:
n/a
>Description:
It looks like unionfs_readdir() has a math problem. My guess as to what was meant:
if (cookies_bk != NULL) {
/* merge cookies */
int size;
u_long *newcookies, *pos;
size = *(ap->a_ncookies) + ncookies_bk;
newcookies = (u_long *) malloc(size * sizeof(u_long),
M_TEMP, M_WAITOK);
pos = newcookies;
memcpy(pos, cookies_bk, ncookies_bk * sizeof(u_long));
- pos += ncookies_bk * sizeof(u_long);
+ pos += ncookies_bk;
memcpy(pos, *(ap->a_cookies), *(ap->a_ncookies) * sizeof(u_long));
free(cookies_bk, M_TEMP);
free(*(ap->a_cookies), M_TEMP);
*(ap->a_ncookies) = size;
*(ap->a_cookies) = newcookies;
}
>How-To-Repeat:
n/a
>Fix:
See Full Description above.
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200903240035.n2O0ZVrr055991>