From 22bd1d5e352aef3e0a92fe683471c4768b321e50 Mon Sep 17 00:00:00 2001 From: Qu Wenruo Date: Thu, 10 May 2018 09:50:01 +0800 Subject: btrfs-progs: print-tree: Enhance btrfs_print_tree() check to avoid out-of-boundary memory access For btrfs_print_tree(), if nr_items is corrupted, it can easily go beyond extent buffer boundary. Add extra nr_item check, and only print as many valid slots as possible. Signed-off-by: Qu Wenruo Signed-off-by: David Sterba --- print-tree.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/print-tree.c b/print-tree.c index b86a7541..a8acb5b3 100644 --- a/print-tree.c +++ b/print-tree.c @@ -1382,6 +1382,7 @@ void btrfs_print_tree(struct extent_buffer *eb, int follow) { u32 i; u32 nr; + u32 ptr_num; struct btrfs_fs_info *fs_info = eb->fs_info; struct btrfs_disk_key disk_key; struct btrfs_key key; @@ -1394,6 +1395,11 @@ void btrfs_print_tree(struct extent_buffer *eb, int follow) btrfs_print_leaf(eb); return; } + /* We are crossing eb boundary, this node must be corrupted */ + if (nr > BTRFS_NODEPTRS_PER_EXTENT_BUFFER(eb)) + warning( + "node nr_items corrupted, has %u limit %u, continue anyway", + nr, BTRFS_NODEPTRS_PER_EXTENT_BUFFER(eb)); printf("node %llu level %d items %d free %u generation %llu owner ", (unsigned long long)eb->start, btrfs_header_level(eb), nr, @@ -1403,8 +1409,10 @@ void btrfs_print_tree(struct extent_buffer *eb, int follow) printf("\n"); print_uuids(eb); fflush(stdout); - for (i = 0; i < nr; i++) { + ptr_num = BTRFS_NODEPTRS_PER_EXTENT_BUFFER(eb); + for (i = 0; i < nr && i < ptr_num; i++) { u64 blocknr = btrfs_node_blockptr(eb, i); + btrfs_node_key(eb, &disk_key, i); btrfs_disk_key_to_cpu(&key, &disk_key); printf("\t"); -- cgit v1.2.3