marko10_000
/
btrfs-progs
forked from Mirrors/btrfs-progs
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

btrfs-progs: print-tree: Enhance btrfs_print_tree() check to avoid out-of-boundary memory access 

For btrfs_print_tree(), if nr_items is corrupted, it can easily go
beyond extent buffer boundary.

Add extra nr_item check, and only print as many valid slots as possible.

Signed-off-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
master
Qu Wenruo 2018-05-10 09:50:01 +08:00 committed by David Sterba
parent 9e2bf8c8ab
commit 22bd1d5e35
1 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
print-tree.c
View File

@ -1382,6 +1382,7 @@ void btrfs_print_tree(struct extent_buffer *eb, int follow)
{
u32 i;
u32 nr;
u32 ptr_num;
struct btrfs_fs_info *fs_info = eb->fs_info;
struct btrfs_disk_key disk_key;
struct btrfs_key key;
@ -1394,6 +1395,11 @@ void btrfs_print_tree(struct extent_buffer *eb, int follow)
btrfs_print_leaf(eb);
return;
}
/* We are crossing eb boundary, this node must be corrupted */
if (nr > BTRFS_NODEPTRS_PER_EXTENT_BUFFER(eb))
warning(
"node nr_items corrupted, has %u limit %u, continue anyway",
nr, BTRFS_NODEPTRS_PER_EXTENT_BUFFER(eb));
printf("node %llu level %d items %d free %u generation %llu owner ",
(unsigned long long)eb->start,
btrfs_header_level(eb), nr,
@ -1403,8 +1409,10 @@ void btrfs_print_tree(struct extent_buffer *eb, int follow)
printf("\n");
print_uuids(eb);
fflush(stdout);
for (i = 0; i < nr; i++) {
ptr_num = BTRFS_NODEPTRS_PER_EXTENT_BUFFER(eb);
for (i = 0; i < nr && i < ptr_num; i++) {
u64 blocknr = btrfs_node_blockptr(eb, i);
btrfs_node_key(eb, &disk_key, i);
btrfs_disk_key_to_cpu(&key, &disk_key);
printf("\t");