diff mbox

[03/12] btrfs-progs: don't overrun name in find-collisions

Message ID 1381182185-10896-4-git-send-email-zab@redhat.com (mailing list archive)
State Accepted, archived
Headers show

Commit Message

Zach Brown Oct. 7, 2013, 9:42 p.m. UTC 
find_collision() allocates name_len bytes for its sub array so the index
must be less than name_len.  This was found by static analysis.

Signed-off-by: Zach Brown <zab@redhat.com>
---
 btrfs-image.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
diff mbox

Patch

diff --git a/btrfs-image.c b/btrfs-image.c
index b05cf07..7474642 100644
--- a/btrfs-image.c
+++ b/btrfs-image.c
@@ -314,11 +314,11 @@  static char *find_collision(struct metadump_struct *md, char *name,
 		if (val->sub[i] == 127) {
 			do {
 				i++;
-				if (i > name_len)
+				if (i >= name_len)
 					break;
 			} while (val->sub[i] == 127);
 
-			if (i > name_len)
+			if (i >= name_len)
 				break;
 			val->sub[i]++;
 			if (val->sub[i] == '/')