bmap_rb_extent is defined as __u64:blk __u64:count. So count can
exceed INT_MAX on populated filesystems.
TESTCASE: xfstest ext4/004
Signed-off-by: Dmitry Monakhov <dmonakhov@openvz.org>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
struct rb_node *parent = NULL, *next, **n;
struct ext2fs_rb_private *bp;
struct bmap_rb_extent *ext;
- int count;
- __u64 pos;
+ __u64 count, pos;
bp = (struct ext2fs_rb_private *) bitmap->private;
n = &bp->root.rb_node;
if (pos >= start + num)
break;
if (pos < start) {
- count -= start - pos;
- if (count < 0)
+ if (pos + count < start)
continue;
+ count -= start - pos;
pos = start;
}
if (pos + count > start + num)