mds: fix possible inode_t::get_layout_size_increment() overflow

CID 717015 (#1 of 1): Unintentional integer overflow (OVERFLOW_BEFORE_WIDEN)
Potentially overflowing expression "this->layout.fl_object_size.operator unsigned int() * this->layout.fl_stripe_count.operator unsigned int()" with type "unsigned int" (32 bits, unsigned) is evaluated using 32-bit arithmetic before being used in a context which expects an expression of type "uint64_t" (64 bits, unsigned). To avoid overflow, cast either operand to "uint64_t" before performing the multiplication.

Signed-off-by: Sage Weil <sage@inktank.com>

diff --git a/src/mds/mdstypes.h b/src/mds/mdstypes.h
index 33b5dd392027c010878ae40cf8864732558358ed..db4dbf1ac61d4cdbd215375548ddc059becc94ab 100644 (file)
--- a/src/mds/mdstypes.h
+++ b/src/mds/mdstypes.h
@@ -442,7 +442,7 @@ struct inode_t {
   }
 
   uint64_t get_layout_size_increment() {
-    return layout.fl_object_size * layout.fl_stripe_count;
+    return (uint64_t)layout.fl_object_size * (uint64_t)layout.fl_stripe_count;
   }
 
   bool is_dirty_rstat() const { return !(rstat == accounted_rstat); }