i2p/haiku-beta6
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

axeld + bonefish:

Browse Source 
Fixed off-by-one error in the b+ tree code splitting a node, which could
result in a read beyond the block bounds thus causing a page fault. Was
nicely reproducible when unzipping big archives. Now bug #1003 seems to
be fixed for real.


git-svn-id: file:///srv/svn/repos/haiku/haiku/trunk@21671 a95241bf-73f2-0310-859d-f6bbb57e9c96
This commit is contained in:
Ingo Weinhold
2007-07-19 21:55:05 +00:00
parent ead2a0814c
commit fd0831b98d
1 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/add-ons/kernel/file_systems/bfs/BPlusTree.cpp
+6 -2
View File
@@ -1189,8 +1189,12 @@ BPlusTree::_SplitNode(bplustree_node *node, off_t nodeOffset,
// move the keys in the old node: the order is important here, // move the keys in the old node: the order is important here,
// because we don't want to overwrite any contents // because we don't want to overwrite any contents
keys = keyIndex <= skip ? out : keyIndex - skip; keys = keyIndex <= skip ? out - 1 : keyIndex - skip;
keyIndex -= skip; keyIndex -= skip;
in = out - keyIndex - 1;
// Note: keyIndex and in will contain invalid values when the new key
// went to the other node. But in this case bytes and bytesAfter are
// 0 and subsequently we never use keyIndex and in.
if (bytesBefore) if (bytesBefore)
memmove(inKeys, inKeys + total, bytesBefore); memmove(inKeys, inKeys + total, bytesBefore);
@@ -1201,8 +1205,8 @@ BPlusTree::_SplitNode(bplustree_node *node, off_t nodeOffset,
if (bytesBefore) if (bytesBefore)
memmove(outKeyLengths, inKeyLengths + skip, keys * sizeof(uint16)); memmove(outKeyLengths, inKeyLengths + skip, keys * sizeof(uint16));
in = out - keyIndex - 1;
if (bytesAfter) { if (bytesAfter) {
// if byteAfter is > 0, keyIndex is larger than skip
memmove(outKeyLengths + keyIndex + 1, inKeyLengths + skip + keyIndex, memmove(outKeyLengths + keyIndex + 1, inKeyLengths + skip + keyIndex,
in * sizeof(uint16)); in * sizeof(uint16));
} }