[PATCH 0/6] bitmap: fix three parsing bugs in bitmap_parse() and bitmap_parselist()
From: shashank
Date: Fri Sep 25 2026 - 06:26:51 EST
This series fixes three cases where the bitmap string parsers accept
input they are documented to reject, or produce a different mask than
the one requested. Each fix is followed by a patch adding the failing
cases to lib/test_bitmap.c.
1-2: bitmap_parse() treats a non-hex character directly before a chunk
of exactly eight hex digits as a separator, so "x12345678" and
"0x0000000f" are accepted while "0xf" is rejected. This is a
regression from the bitmap_parse() rework; the old __bitmap_parse()
rejected all of them.
3-4: bitmap_parselist() does not check for the end of the region after
the group size of a "range:used/group" region, so since N and
all became valid region starts, "0-7:1/2N" or "0-7:1/2all" are
silently parsed as two regions.
5-6: bitmap_parselist() walks a "range:used/group" region with an
unsigned int that wraps around when the group size is close to
UINT_MAX, setting bits below the requested range. This needs an
absurd group size and never writes out of bounds.
With the series applied, test_bitmap reports "all 391544 tests passed"
(UML, x86_64). The three fixes are independent and can be applied in
any order.
smjain (6):
bitmap: bitmap_parse(): reject non-hex character before 8 digits
bitmap: test bitmap_parse() with an illegal character before 8 hex
digits
bitmap: bitmap_parselist(): reject trailing characters after group
size
bitmap: test bitmap_parselist() with text after the group size
bitmap: bitmap_parselist(): don't wrap around on a huge group size
bitmap: test bitmap_parselist() with a group size close to UINT_MAX
lib/bitmap-str.c | 24 +++++++++++++++++++-----
lib/test_bitmap.c | 9 +++++++++
2 files changed, 28 insertions(+), 5 deletions(-)
--
2.43.0