Commit 38901e0f authored by Alex Elder's avatar Alex Elder

rbd: check for overflow in rbd_get_num_segments()

The return type of rbd_get_num_segments() is int, but the values it
operates on are u64.  Although it's not likely, there's no guarantee
the result won't exceed what can be respresented in an int.  The
function is already designed to return -ERANGE on error, so just add
this possible overflow as another reason to return that.
Signed-off-by: default avatarAlex Elder <elder@inktank.com>
Reviewed-by: default avatarDan Mick <dan.mick@inktank.com>
Reviewed-by: default avatarJosh Durgin <josh.durgin@inktank.com>
parent 98571b5a
...@@ -820,6 +820,7 @@ static int rbd_get_num_segments(struct rbd_image_header *header, ...@@ -820,6 +820,7 @@ static int rbd_get_num_segments(struct rbd_image_header *header,
{ {
u64 start_seg; u64 start_seg;
u64 end_seg; u64 end_seg;
u64 result;
if (!len) if (!len)
return 0; return 0;
...@@ -829,7 +830,11 @@ static int rbd_get_num_segments(struct rbd_image_header *header, ...@@ -829,7 +830,11 @@ static int rbd_get_num_segments(struct rbd_image_header *header,
start_seg = ofs >> header->obj_order; start_seg = ofs >> header->obj_order;
end_seg = (ofs + len - 1) >> header->obj_order; end_seg = (ofs + len - 1) >> header->obj_order;
return end_seg - start_seg + 1; result = end_seg - start_seg + 1;
if (result > (u64) INT_MAX)
return -ERANGE;
return (int) result;
} }
/* /*
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment