[Ocfs2-tools-devel] [PATCH] libocfs2: Prevent endian swapping from scribbling over memory.

[Joel Becker]

On Fri, Jun 26, 2009 at 01:19:20PM +0800, Tao Ma wrote:
> Hi Joel,
> 	The idea is cool. Just one small comment.
> 
> Joel Becker wrote:
> <snip>
> >+static void ocfs2_swap_xattr_entries_to_cpu(ocfs2_filesys *fs, void *obj,
> >+					    size_t objsize,
> >+					    struct ocfs2_xattr_header *xh)
> > {
> > 	uint16_t i;
> >+	char *value;
> >+	ocfs2_filesys fake_fs = {
> >+		.fs_blocksize = objsize,
> >+	};
> > 	if (cpu_is_little_endian)
> > 		return;
> >@@ -116,23 +133,40 @@ static void ocfs2_swap_xattr_entries_to_cpu(struct ocfs2_xattr_header *xh)
> > 	for (i = 0; i < xh->xh_count; i++) {
> > 		struct ocfs2_xattr_entry *xe = &xh->xh_entries[i];
> >+		if (ocfs2_swap_barrier(&fake_fs, obj, xe,
> >+				       sizeof(struct ocfs2_xattr_entry)))
> >+			break;
> >+
> > 		ocfs2_swap_xattr_entry(xe);
> >+		value = (char *)xh + xe->xe_name_offset +
> >+			OCFS2_XATTR_SIZE(xe->xe_name_len);
> >+
> > 		if (!ocfs2_xattr_is_local(xe)) {
> > 			struct ocfs2_xattr_value_root *xr =
> >-				(struct ocfs2_xattr_value_root *)
> >-				((char *)xh + xe->xe_name_offset +
> >-				OCFS2_XATTR_SIZE(xe->xe_name_len));
> >+				(struct ocfs2_xattr_value_root *)value;
> >+
> >+			if (ocfs2_swap_barrier(&fake_fs, obj, xr,
> >+					       OCFS2_XATTR_ROOT_SIZE))
> >+				break;
> > 			ocfs2_swap_xattr_value_root(xr);
> >-			ocfs2_swap_extent_list_to_cpu(&xr->xr_list);
> >-		}
> >+			ocfs2_swap_extent_list_to_cpu(fs, xh, &xr->xr_list);
> >+		} else if (ocfs2_swap_barrier(&fake_fs, obj, value,
> >+					      xe->xe_value_size))
> here we may need to use OCFS2_XATTR_SIZE(xe->xe_value_size) since
> actually it is aligned. The same goes for
> ocfs2_swap_xattr_entries_from_cpu.

	good catch.  I'll fix it up.

Joel

-- 

"If at first you don't succeed, cover all traces that you tried."
                                                        -Unknown

Joel Becker
Principal Software Developer
Oracle
E-mail: joel.becker at oracle.com
Phone: (650) 506-8127