[Gptfdisk-general] Code defects in gptfdisk basicmbr

[Ivan M. <i.m...@sa...>]

Hello,

 

Looking into basicmbr.cc, there’s the following code (added in commit 23d8d54c):

 

   while (another && (partNum < MAX_MBR_PARTS) && (partNum >= 0) && (allOK > 0)) {

      for (i = 0; i < MAX_MBR_PARTS; i++) {

         if (EbrLocations[i] == offset) { // already read this one; infinite logical partition loop!

            cerr << "Logical partition infinite loop detected! This is being corrected.\n";

            allOK = -1;

            partNum -= 1;

         } // if

      } // for

      EbrLocations[partNum] = offset;

      …

      if ((partNum >= 0) && (partNum < MAX_MBR_PARTS) && (allOK > 0)) {

 

1.       Is it guaranteed by the algorithm that after the decrement partNum still be non-negative when accessing the array?

2.       The second checking of partNum (after array access) is redundant.

 

References:

[1] https://sourceforge.net/p/gptfdisk/code/ci/23d8d54c/#diff-3

[2] https://android-review.googlesource.com/#/c/platform/external/gptfdisk/+/224286/1/basicmbr.cc 

 

------------

Best regards,

Ivan Maidanski