[PATCH 5] libfs/rfs: Check search bit map end on last bit

[Joel Sherrill]

Does this need to go on 4.11 as well? I can't imaging this code has changed.

May even be the same in 4.10.

On Thu, Oct 15, 2020 at 1:40 AM <chrisj at rtems.org> wrote:

> From: Chris Johns <chrisj at rtems.org>
>
> - Do not write past the last location of the search bit map
>   whe nit is being created.
>
> Closes #4149
> ---
>  cpukit/libfs/src/rfs/rtems-rfs-bitmaps.c | 17 +++++++++++++++--
>  1 file changed, 15 insertions(+), 2 deletions(-)
>
> diff --git a/cpukit/libfs/src/rfs/rtems-rfs-bitmaps.c
> b/cpukit/libfs/src/rfs/rtems-rfs-bitmaps.c
> index 7973e85083..6da555d50e 100644
> --- a/cpukit/libfs/src/rfs/rtems-rfs-bitmaps.c
> +++ b/cpukit/libfs/src/rfs/rtems-rfs-bitmaps.c
> @@ -34,6 +34,12 @@
>  #include <stdlib.h>
>  #include <rtems/rfs/rtems-rfs-bitmaps.h>
>
> +#define rtems_rfs_bitmap_check(_c, _sm) \
> +   _Assert(_sm >= _c->search_bits && \
> +           _sm < (_c->search_bits + \
> +
>  rtems_rfs_bitmap_elements(rtems_rfs_bitmap_elements(_c->size))))
> +
> +
>  /**
>   * Test a bit in an element. If set return true else return false.
>   *
> @@ -220,6 +226,7 @@ rtems_rfs_bitmap_map_set (rtems_rfs_bitmap_control*
> control,
>      index  = rtems_rfs_bitmap_map_index (bit);
>      offset = rtems_rfs_bitmap_map_offset (bit);
>      search_map[index] = rtems_rfs_bitmap_set (search_map[index], 1 <<
> offset);
> +    rtems_rfs_bitmap_check(control, &search_map[index]);
>    }
>
>    return 0;
> @@ -260,6 +267,7 @@ rtems_rfs_bitmap_map_clear (rtems_rfs_bitmap_control*
> control,
>    index             = rtems_rfs_bitmap_map_index (bit);
>    offset            = rtems_rfs_bitmap_map_offset(bit);
>    search_map[index] = rtems_rfs_bitmap_clear (search_map[index], 1 <<
> offset);
> +  rtems_rfs_bitmap_check(control, &search_map[index]);
>    rtems_rfs_buffer_mark_dirty (control->buffer);
>    control->free++;
>
> @@ -599,6 +607,7 @@ rtems_rfs_bitmap_create_search
> (rtems_rfs_bitmap_control* control)
>    size = control->size;
>    bit = 0;
>
> +  rtems_rfs_bitmap_check(control, search_map);
>    *search_map = RTEMS_RFS_BITMAP_ELEMENT_CLEAR;
>    while (size)
>    {
> @@ -633,8 +642,12 @@ rtems_rfs_bitmap_create_search
> (rtems_rfs_bitmap_control* control)
>      if (bit == (rtems_rfs_bitmap_element_bits () - 1))
>      {
>        bit = 0;
> -      search_map++;
> -      *search_map = RTEMS_RFS_BITMAP_ELEMENT_CLEAR;
> +      if (size > 0)
> +      {
> +        search_map++;
> +        rtems_rfs_bitmap_check(control, search_map);
> +        *search_map = RTEMS_RFS_BITMAP_ELEMENT_CLEAR;
> +      }
>      }
>      else
>        bit++;
> --
> 2.24.1
>
> _______________________________________________
> devel mailing list
> devel at rtems.org
> http://lists.rtems.org/mailman/listinfo/devel
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.rtems.org/pipermail/devel/attachments/20201015/1493f352/attachment.html>