Re: fs/ufs/inode.c:817: warning: array subscript is above array bounds

[Evgeniy Dushistov]

On Wed, Jan 31, 2007 at 01:24:32PM -0800, Andrew Morton wrote:
> On Wed, 31 Jan 2007 23:10:57 +0300
> "Tomasz Kvarsin" <kvarsin@xxxxxxxxx> wrote:
> 
> > d binderman wrote:
> > >Hello there,
> > >
> > >I just tried to compile Linux kernel 2.6.19.2 with the
> > >new GNU C compiler version 4.3 snapshot 20070126.
> > >
> > >The compiler said
> > >
> > >fs/ufs/inode.c:817: warning: array subscript is above array bounds
> > >
> > >The source code is
> > >
> > >        for (i = 0; i < (UFS_NDADDR + UFS_NINDIR); i++)
> > >            ufs_inode->ui_u2.ui_addr.ui_db[i] = ufsi->i_u1.i_data[i];
> > >
> > >but
> > >
> > >./include/linux/ufs_fs.h:                       __fs32  ui_db[UFS_NDADDR];/*
> > >0x28 data blocks */
> > >./include/linux/ufs_fs.h:                       __fs64
> > >ui_db[UFS_NDADDR]; /* 112: Direct disk blocks. */
> > >
> > >and
> > >
> > >        __fs32  i_data[15];
> > >
> > >and
> > >
> > >#define UFS_NDADDR 12
> > >#define UFS_NINDIR 3
> > >
> > >so the kernel seems to be trying to write fifteen bytes into an array only
> > >twelve
> > >bytes in size. Suggest code rework.

Actually, this is not a _real_ bug,
yes, 
for (i = 0; i < (UFS_NDADDR + UFS_NINDIR); i++)
	ufs_inode->ui_u2.ui_addr.ui_db[i]

and ui_db only ui_db[UFS_NDADDR], but if look on more high level,
then:
union {
struct {
     __fs64     ui_db[UFS_NDADDR]; /* 112: Direct disk blocks. */
      __fs64     ui_ib[UFS_NINDIR];/* 208: Indirect disk blocks.*/
} ui_addr;
} ui_u2;

have no idea, why array splited on two parts,
may be some macros used this feature.

-- 
/Evgeniy

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/