diff mbox

Btrfs-progs: sanity check the number of items in a leaf

Message ID 1367953790-23756-1-git-send-email-jbacik@fusionio.com (mailing list archive)
State Under Review, archived
Headers show

Commit Message

Josef Bacik May 7, 2013, 7:09 p.m. UTC
I hit this while working on fsck, I got some weird corruption where the number
of items was way higher than what would fit in a leaf, which would make things
blow up.  This fixes the problem by catching it and returning an error so we
gracefully exit instead of segfaulting.  Thanks,

Signed-off-by: Josef Bacik <jbacik@fusionio.com>
 ctree.c |    6 ++++++
 1 files changed, 6 insertions(+), 0 deletions(-)
diff mbox


diff --git a/ctree.c b/ctree.c
index 16f4daa..851d14a 100644
--- a/ctree.c
+++ b/ctree.c
@@ -638,6 +638,12 @@  int btrfs_check_leaf(struct btrfs_root *root,
 	struct btrfs_disk_key key;
 	u32 nritems = btrfs_header_nritems(buf);
+	if (nritems == 0 || nritems * sizeof(struct btrfs_item) > buf->len)  {
+		fprintf(stderr, "invalid number of items %llu\n",
+			(unsigned long long)buf->start);
+		goto fail;
+	}
 	if (btrfs_header_level(buf) != 0) {
 		fprintf(stderr, "leaf is not a leaf %llu\n",
 		       (unsigned long long)btrfs_header_bytenr(buf));