diff options
| author | Anton Altaparmakov <aia21@cantab.net> | 2005-09-08 16:46:55 +0100 |
|---|---|---|
| committer | Anton Altaparmakov <aia21@cantab.net> | 2005-09-08 16:46:55 +0100 |
| commit | 84d6ebe63f50b6efd8be252b58a207132157c60f (patch) | |
| tree | 5e78199877a800c92528c2ed0272c863d2c9733c | |
| parent | 9529d461d0992959026264b8fc002ac01d226708 (diff) | |
NTFS: Fix two nasty runlist merging bugs that had gone unnoticed so far.
Thanks to Stefano Picerno for the bug report.
Signed-off-by: Anton Altaparmakov <aia21@cantab.net>
| -rw-r--r-- | fs/ntfs/ChangeLog | 2 | ||||
| -rw-r--r-- | fs/ntfs/runlist.c | 5 |
2 files changed, 5 insertions, 2 deletions
diff --git a/fs/ntfs/ChangeLog b/fs/ntfs/ChangeLog index c5bbedff5ae..4bc8f91c5fc 100644 --- a/fs/ntfs/ChangeLog +++ b/fs/ntfs/ChangeLog @@ -43,6 +43,8 @@ ToDo/Notes: - Use ntfs_malloc_nofs_nofail() in the two critical regions in fs/ntfs/runlist.c::ntfs_runlists_merge(). This means we no longer need to panic() if the allocation fails as it now cannot fail. + - Fix two nasty runlist merging bugs that had gone unnoticed so far. + Thanks to Stefano Picerno for the bug report. 2.1.23 - Implement extension of resident files and make writing safe as well as many bug fixes, cleanups, and enhancements... diff --git a/fs/ntfs/runlist.c b/fs/ntfs/runlist.c index 3bb4a57d1fa..d26a1be530c 100644 --- a/fs/ntfs/runlist.c +++ b/fs/ntfs/runlist.c @@ -542,6 +542,7 @@ runlist_element *ntfs_runlists_merge(runlist_element *drl, /* Scan to the end of the source runlist. */ for (dend = 0; likely(drl[dend].length); dend++) ; + dend++; drl = ntfs_rl_realloc(drl, dend, dend + 1); if (IS_ERR(drl)) return drl; @@ -611,8 +612,8 @@ runlist_element *ntfs_runlists_merge(runlist_element *drl, ((drl[dins].vcn + drl[dins].length) <= /* End of hole */ (srl[send - 1].vcn + srl[send - 1].length))); - /* Or we'll lose an end marker */ - if (start && finish && (drl[dins].length == 0)) + /* Or we will lose an end marker. */ + if (finish && !drl[dins].length) ss++; if (marker && (drl[dins].vcn + drl[dins].length > srl[send - 1].vcn)) finish = FALSE; |