Author: korli Date: 2011-01-09 11:24:32 +0100 (Sun, 09 Jan 2011) New Revision: 40175 Changeset: http://dev.haiku-os.org/changeset/40175 Ticket: http://dev.haiku-os.org/ticket/7074 Modified: haiku/trunk/src/add-ons/kernel/file_systems/ext2/BitmapBlock.cpp Log: data[maxIndex] can only be accessed safely when maxBit is non zero. I missed this in r40143. This bug only happens for bitmaps with unusual lengths (often the last blockgroup block bitmap) and which happen to be full. Should fix #7074. Modified: haiku/trunk/src/add-ons/kernel/file_systems/ext2/BitmapBlock.cpp =================================================================== --- haiku/trunk/src/add-ons/kernel/file_systems/ext2/BitmapBlock.cpp 2011-01-09 04:10:13 UTC (rev 40174) +++ haiku/trunk/src/add-ons/kernel/file_systems/ext2/BitmapBlock.cpp 2011-01-09 10:24:32 UTC (rev 40175) @@ -410,7 +410,7 @@ TRACE("BitmapBlock::FindNextMarked(): index: %lu, bit: %lu, mask: %lX, " "bits: %lX\n", index, bit, mask, bits); - bits = bits & ~mask; + bits &= ~mask; uint32 maxBit = 32; if (bits == 0) { @@ -422,7 +422,6 @@ index++; } while (index < maxIndex && data[index] == 0); - bits = B_LENDIAN_TO_HOST_INT32(data[index]); if (index >= maxIndex) { maxBit = fNumBits & 0x1F; @@ -433,14 +432,15 @@ pos = fNumBits; return; } + bits = B_LENDIAN_TO_HOST_INT32(data[maxIndex]); mask = (1 << maxBit) - 1; if ((bits & mask) == 0) { pos = fNumBits; return; } maxBit++; - } - + } else + bits = B_LENDIAN_TO_HOST_INT32(data[index]); bit = 0; } @@ -493,7 +493,6 @@ index++; } while (index < maxIndex && data[index] == 0xFFFFFFFF); - bits = B_LENDIAN_TO_HOST_INT32(data[index]); if (index >= maxIndex) { maxBit = fNumBits & 0x1F; @@ -504,13 +503,15 @@ pos = fNumBits; return; } + bits = B_LENDIAN_TO_HOST_INT32(data[maxIndex]); mask = (1 << maxBit) - 1; if ((bits & mask) == mask) { pos = fNumBits; return; } maxBit++; - } + } else + bits = B_LENDIAN_TO_HOST_INT32(data[index]); bit = 0; }