Gitiles
Code Review Sign In
gerrit-public.fairphone.software / fp2-dev / platform / external / fio / 6a7a92156a09ff66fd3e0ea062f2cdb339ca73c5
commit6a7a92156a09ff66fd3e0ea062f2cdb339ca73c5[log] [tgz]
authorSitsofe Wheeler <sitsofe@yahoo.com>Thu Feb 13 07:06:40 2014 +0000
committerJens Axboe <axboe@fb.com>Thu Feb 13 09:18:29 2014 -0700
tree46957dd9000b8818842ab70df24690e49dd4a2c6
parent2d60ad8ee888dcb0cabc8c561b996db79dca4b00 [diff]
io_u_qiter: Fix buffer overrun

In io_u_queue.h the io_u_qiter macro is loops around io_u_queue
structures. The problem comes with the end of loop initialisation:
i++, io_u = (q)->io_us[i]
For example, if io_us consists of one element and i is 0 then after the
first iteration is completed i++, io_u = (q)->io_us[i] will access
beyond the end of io_us.

Fix this by moving io_u initialisation to the expression part of the for
loop (yuck).

Found by Dr Memory.

Signed-off-by: Sitsofe Wheeler <sitsofe@yahoo.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
1 file changed
tree: 46957dd9000b8818842ab70df24690e49dd4a2c6
  1. arch/
  2. compiler/
  3. crc/
  4. engines/
  5. examples/
  6. lib/
  7. os/
  8. profiles/
  9. t/
  10. tools/
  11. .gitignore
  12. backend.c
  13. blktrace.c
  14. blktrace_api.h
  15. cairo_text_helpers.c
  16. cairo_text_helpers.h
  17. cconv.c
  18. cgroup.c
  19. cgroup.h
  20. client.c
  21. client.h
  22. configure
  23. COPYING
  24. debug.c
  25. debug.h
  26. diskutil.c
  27. diskutil.h
  28. err.h
  29. eta.c
  30. fifo.c
  31. fifo.h
  32. file.h
  33. filehash.c
  34. filehash.h
  35. filesetup.c
  36. FIO-VERSION-GEN
  37. fio.1
  38. fio.c
  39. fio.h
  40. flist.h
  41. flow.c
  42. flow.h
  43. gclient.c
  44. gclient.h
  45. gcompat.c
  46. gcompat.h
  47. gerror.c
  48. gerror.h
  49. gettime-thread.c
  50. gettime.c
  51. gettime.h
  52. GFIO-TODO
  53. gfio.c
  54. gfio.h
  55. ghelpers.c
  56. ghelpers.h
  57. goptions.c
  58. goptions.h
  59. graph.c
  60. graph.h
  61. hash.h
  62. helpers.c
  63. helpers.h
  64. HOWTO
  65. idletime.c
  66. idletime.h
  67. init.c
  68. io_ddir.h
  69. io_u.c
  70. io_u_queue.c
  71. io_u_queue.h
  72. ioengine.h
  73. ioengines.c
  74. iolog.c
  75. iolog.h
  76. json.c
  77. json.h
  78. libfio.c
  79. LICENSE
  80. log.c
  81. log.h
  82. Makefile
  83. memalign.c
  84. memalign.h
  85. memory.c
  86. minmax.h
  87. mutex.c
  88. mutex.h
  89. options.c
  90. options.h
  91. parse.c
  92. parse.h
  93. printing.c
  94. printing.h
  95. profile.c
  96. profile.h
  97. README
  98. REPORTING-BUGS
  99. SERVER-TODO
  100. server.c
  101. server.h
  102. smalloc.c
  103. smalloc.h
  104. stat.c
  105. stat.h
  106. td_error.c
  107. td_error.h
  108. thread_options.h
  109. tickmarks.c
  110. tickmarks.h
  111. time.c
  112. time.h
  113. trim.c
  114. trim.h
  115. verify.c
  116. verify.h