Hi Jinseok,
On Tue, 18 Aug 2026, Jinseok Kim wrote:
> fsx-linux: Fix reference buffer corruption in op_map_read()
--- [PATCH 2/2] ---
> + max_len = fsize - pos->offset;
> + if (max_len > op_max_size)
> + max_len = op_max_size;
> +
> + pos->size = random() % max_len;
>
> diff = pos->offset % align;
>
> if (diff) {
> pos->offset -= diff;
> pos->size += diff;
> }
Could the offset be aligned before max_len is calculated, or could the final
size be capped after alignment?
The new cap bounds pos->size only before offset % align is added back. With
-o 1 -w 4096, pos->size starts at zero and can then grow to 4095 bytes, so
-o still is not an upper bound. This also affects the existing fsx05 entry,
which combines -o 1024 with -w 4096.
Verdict - Needs revision
---
Note:
The agent can sometimes produce false positives although often its
findings are genuine. If you find issues with the review, please
comment this email or ignore the suggestions.
Regards,
LTP AI Reviewer
--
Mailing list info: https://lists.linux.it/listinfo/ltp
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.