[parted-devel] [PATCH 1/2] hurd: Fix gnu_read problems with block size > 512b

[Brian C. Lane]

This fixes offset calculations when the block size is larger than 512b
by checking for negative offsets, and skips the copy of the length is
zero.

NOTE: This error was found by an AI scan of parted by AISLE, and the
patch is mostly the patch suggested by the analysis. It has been
reviewed by Samuel and I.

Signed-off-by: Brian C. Lane <bcl at redhat.com>
Signed-off-by: Samuel Thibault <samuel.thibault at ens-lyon.org>
Assisted-by: AISLE in partnership with Red Hat
---
 libparted/arch/gnu.c | 29 ++++++++++++++++++++++-------
 1 file changed, 22 insertions(+), 7 deletions(-)

diff --git a/libparted/arch/gnu.c b/libparted/arch/gnu.c
index fc64f42b..5d5cbc93 100644
--- a/libparted/arch/gnu.c
+++ b/libparted/arch/gnu.c
@@ -512,13 +512,28 @@ retry:
 			}
 		}
 
-		memcpy (user_buffer + have_read - read_offset,
-			store_read_buffer
-			+ (have_read >= read_offset
-				? 0 : read_offset - have_read),
-			have_read + did_read > device_read_length + read_offset
-				? device_read_length + read_offset - have_read
-				: did_read);
+		size_t src_off = (have_read >= read_offset) ? 0 : (read_offset - have_read);
+		size_t dst_off = (have_read > read_offset) ? (have_read - read_offset) : 0;
+		size_t copy_len = (have_read + did_read > device_read_length + read_offset)
+			? (device_read_length + read_offset - have_read)
+			: did_read;
+
+		/* Remove skipped prefix from source window.  */
+		if (src_off >= copy_len)
+			copy_len = 0;
+		else
+			copy_len -= src_off;
+
+		/* Clamp to caller buffer bounds.  */
+		if (dst_off >= device_read_length)
+			copy_len = 0;
+		else if (dst_off + copy_len > device_read_length )
+			copy_len = device_read_length - dst_off;
+
+		if (copy_len)
+			memcpy ((char*) user_buffer + dst_off,
+				(char*) store_read_buffer + src_off,
+				copy_len);
 
 		if (store_read_buffer != local_buffer)
 			vm_deallocate (mach_task_self (),
-- 
2.55.0