Re: [PATCH] SquashFS, XZ: Don't use uninitialized variable in squashfs_xz_uncompress

[Phillip Lougher <phillip@lougher.demon.co.uk>]

On 24/01/11 22:43, Andrew Morton wrote:
> On Thu, 20 Jan 2011 21:53:23 +0100 (CET)
> Jesper Juhl<jj@chaosbits.net>  wrote:
>
>> In fs/squashfs/xz_wrapper.c::squashfs_xz_uncompress() we have this code:
>>
>> 	enum xz_ret xz_err;
>> 	...
>> 	do {
>> 		if (stream->buf.in_pos == stream->buf.in_size&&  k<  b) {
>> 		... [nothing that assigns to 'xz_err'] ...
>> 			if (avail == 0) {
>> 				offset = 0;
>> 				put_bh(bh[k++]);
>> 				continue;
>
> hm, maybe.  The handling of the `avail == 0' case looks odd.  It sits
> there in a loop doing wait_on_buffer() against buffers which it will
> never use and possible reporting -EIO for a buffer which it didn't use,
> which seems bogus.

Hi Andrew,

I'm just about to send out a patch that fixes this uninitialised variable
bug by way of getting rid of that if (avail == 0) case.

The avail == 0 case is a workaround for the fact that the caller code
can occasionally pass a buffer head that has already been
consumed (read offset into buffer head is at the end of the buffer).

Phillip