marko10_000
/
btrfs-progs
forked from Mirrors/btrfs-progs
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

btrfs-progs: dump-super: check array_size in print_sys_chunk_array 

Without validation of array_size, the dump-super may lead to a bad
memory access.

Signed-off-by: Lu Fengqi <lufq.fnst@cn.fujitsu.com>
Signed-off-by: David Sterba <dsterba@suse.com>
master
Lu Fengqi 2017-04-20 16:07:56 +08:00 committed by David Sterba
parent beb924e12d
commit d5213118a5
1 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
cmds-inspect-dump-super.c
View File

@ -65,13 +65,20 @@ static void print_sys_chunk_array(struct btrfs_super_block *sb)
buf = malloc(sizeof(*buf) + sizeof(*sb));
if (!buf) {
error("not enough memory");
goto out;
return;
}
write_extent_buffer(buf, sb, 0, sizeof(*sb));
array_size = btrfs_super_sys_array_size(sb);
array_ptr = sb->sys_chunk_array;
sb_array_offset = offsetof(struct btrfs_super_block, sys_chunk_array);
if (array_size > BTRFS_SYSTEM_CHUNK_ARRAY_SIZE) {
error("sys_array_size %u shouldn't exceed %u bytes",
array_size, BTRFS_SYSTEM_CHUNK_ARRAY_SIZE);
goto out;
}
cur_offset = 0;
item = 0;
@ -124,8 +131,8 @@ static void print_sys_chunk_array(struct btrfs_super_block *sb)
item++;
}
free(buf);
out:
free(buf);
return;
out_short_read: