I hit this while working on fsck, I got some weird corruption where the number
of items was way higher than what would fit in a leaf, which would make things
blow up. This fixes the problem by catching it and returning an error so we
gracefully exit instead of segfaulting. Thanks,
Signed-off-by: Josef Bacik <jbacik@xxxxxxxxxxxx>
---
ctree.c | 6 ++++++
1 files changed, 6 insertions(+), 0 deletions(-)
diff --git a/ctree.c b/ctree.c
index 16f4daa..851d14a 100644
--- a/ctree.c
+++ b/ctree.c
@@ -638,6 +638,12 @@ int btrfs_check_leaf(struct btrfs_root *root,
struct btrfs_disk_key key;
u32 nritems = btrfs_header_nritems(buf);
+ if (nritems == 0 || nritems * sizeof(struct btrfs_item) > buf->len) {
+ fprintf(stderr, "invalid number of items %llu\n",
+ (unsigned long long)buf->start);
+ goto fail;
+ }
+
if (btrfs_header_level(buf) != 0) {
fprintf(stderr, "leaf is not a leaf %llu\n",
(unsigned long long)btrfs_header_bytenr(buf));
--
1.7.7.6
--
To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
