path: root/ctree.c
diff options
authorJosef Bacik <>2013-05-09 13:56:19 +0000
committerChris Mason <>2013-05-10 10:56:59 -0400
commit850581d48a9039367c308a07f4959682a4e24429 (patch)
tree52eaa55f5b1b325aa25cd5e77e19fe544462263e /ctree.c
parent0ba706acd85576ebda89058b7260bf12c926ddac (diff)
Btrfs-progs: sanity check the number of items in a leaf V2
I hit this while working on fsck, I got some weird corruption where the number of items was way higher than what would fit in a leaf, which would make things blow up. This fixes the problem by catching it and returning an error so we gracefully exit instead of segfaulting. Thanks, Signed-off-by: Josef Bacik <> Signed-off-by: Chris Mason <>
Diffstat (limited to 'ctree.c')
1 files changed, 6 insertions, 0 deletions
diff --git a/ctree.c b/ctree.c
index 16f4daa9..4598665f 100644
--- a/ctree.c
+++ b/ctree.c
@@ -638,6 +638,12 @@ int btrfs_check_leaf(struct btrfs_root *root,
struct btrfs_disk_key key;
u32 nritems = btrfs_header_nritems(buf);
+ if (nritems * sizeof(struct btrfs_item) > buf->len) {
+ fprintf(stderr, "invalid number of items %llu\n",
+ (unsigned long long)buf->start);
+ goto fail;
+ }
if (btrfs_header_level(buf) != 0) {
fprintf(stderr, "leaf is not a leaf %llu\n",
(unsigned long long)btrfs_header_bytenr(buf));