diff options
| author | Qu Wenruo <wqu@suse.com> | 2018-05-10 09:50:01 +0800 |
|---|---|---|
| committer | David Sterba <dsterba@suse.com> | 2018-06-07 16:37:38 +0200 |
| commit | 22bd1d5e352aef3e0a92fe683471c4768b321e50 (patch) | |
| tree | c6018e7c0077811665173c5136303b81ae01123a /print-tree.c | |
| parent | 9e2bf8c8abecf878ea5928f2751e92433af124c7 (diff) | |
btrfs-progs: print-tree: Enhance btrfs_print_tree() check to avoid out-of-boundary memory access
For btrfs_print_tree(), if nr_items is corrupted, it can easily go
beyond extent buffer boundary.
Add extra nr_item check, and only print as many valid slots as possible.
Signed-off-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Diffstat (limited to 'print-tree.c')
| -rw-r--r-- | print-tree.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/print-tree.c b/print-tree.c index b86a7541..a8acb5b3 100644 --- a/print-tree.c +++ b/print-tree.c @@ -1382,6 +1382,7 @@ void btrfs_print_tree(struct extent_buffer *eb, int follow) { u32 i; u32 nr; + u32 ptr_num; struct btrfs_fs_info *fs_info = eb->fs_info; struct btrfs_disk_key disk_key; struct btrfs_key key; @@ -1394,6 +1395,11 @@ void btrfs_print_tree(struct extent_buffer *eb, int follow) btrfs_print_leaf(eb); return; } + /* We are crossing eb boundary, this node must be corrupted */ + if (nr > BTRFS_NODEPTRS_PER_EXTENT_BUFFER(eb)) + warning( + "node nr_items corrupted, has %u limit %u, continue anyway", + nr, BTRFS_NODEPTRS_PER_EXTENT_BUFFER(eb)); printf("node %llu level %d items %d free %u generation %llu owner ", (unsigned long long)eb->start, btrfs_header_level(eb), nr, @@ -1403,8 +1409,10 @@ void btrfs_print_tree(struct extent_buffer *eb, int follow) printf("\n"); print_uuids(eb); fflush(stdout); - for (i = 0; i < nr; i++) { + ptr_num = BTRFS_NODEPTRS_PER_EXTENT_BUFFER(eb); + for (i = 0; i < nr && i < ptr_num; i++) { u64 blocknr = btrfs_node_blockptr(eb, i); + btrfs_node_key(eb, &disk_key, i); btrfs_disk_key_to_cpu(&key, &disk_key); printf("\t"); |