From 850581d48a9039367c308a07f4959682a4e24429 Mon Sep 17 00:00:00 2001 From: Josef Bacik Date: Thu, 9 May 2013 13:56:19 +0000 Subject: [PATCH] Btrfs-progs: sanity check the number of items in a leaf V2 I hit this while working on fsck, I got some weird corruption where the number of items was way higher than what would fit in a leaf, which would make things blow up. This fixes the problem by catching it and returning an error so we gracefully exit instead of segfaulting. Thanks, Signed-off-by: Josef Bacik Signed-off-by: Chris Mason --- ctree.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/ctree.c b/ctree.c index 16f4daa9..4598665f 100644 --- a/ctree.c +++ b/ctree.c @@ -638,6 +638,12 @@ int btrfs_check_leaf(struct btrfs_root *root, struct btrfs_disk_key key; u32 nritems = btrfs_header_nritems(buf); + if (nritems * sizeof(struct btrfs_item) > buf->len) { + fprintf(stderr, "invalid number of items %llu\n", + (unsigned long long)buf->start); + goto fail; + } + if (btrfs_header_level(buf) != 0) { fprintf(stderr, "leaf is not a leaf %llu\n", (unsigned long long)btrfs_header_bytenr(buf));