This could crash before because of dangerous dangling
offset of pointer.
Signed-off-by: Robert Marklund <robbelibobban@xxxxxxxxx>
---
cmds-check.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/cmds-check.c b/cmds-check.c
index 778f141..da36758 100644
--- a/cmds-check.c
+++ b/cmds-check.c
@@ -8906,6 +8906,16 @@ static int build_roots_info_cache(struct btrfs_fs_info *info)
goto next;
ei = btrfs_item_ptr(leaf, slot, struct btrfs_extent_item);
+
+ if ((long long)ei > info->extent_root->leafsize) {
+ fprintf(stderr, "Bad leaf = %p, slot = %d\n", leaf, slot);
+ fprintf(stderr, "item ptr = %p\n", ei);
+ fprintf(stderr, "objectid = %llx\n", found_key.objectid);
+ fprintf(stderr, "type = %x\n", found_key.type);
+ fprintf(stderr, "offset = %llx\n", found_key.offset);
+ goto next;
+ }
+
flags = btrfs_extent_flags(leaf, ei);
if (found_key.type == BTRFS_EXTENT_ITEM_KEY &&
--
2.1.0
--
To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
