From 521770b7a9bef17dcbcee514da5052b3e06120d2 Mon Sep 17 00:00:00 2001 From: Jeff Liu Date: Wed, 31 Aug 2011 12:35:51 +0800 Subject: Btrfs-progs: specify label length larger than 255 bytes cause mkfs.btrfs buffer overflow Hello, While going through the mkfs.c, I noticed there is an issue for label length checking, mkfs.btrfs will crashed if the label length exceeding 255 bytes, it's easy to triggered that out as below: jeff@pibroch:~/opensource/btrfs-progs$ sudo ./mkfs.btrfs -L `perl -e 'print "A"x256'` /usr/src/linux-3.0/img0 WARNING! - Btrfs v0.19-35-g1b444cd IS EXPERIMENTAL WARNING! - see http://btrfs.wiki.kernel.org before using *** buffer overflow detected ***: ./mkfs.btrfs terminated ======= Backtrace: ========= /lib/i386-linux-gnu/libc.so.6(__fortify_fail+0x50)[0xb7774df0] /lib/i386-linux-gnu/libc.so.6(+0xe4cca)[0xb7773cca] /lib/i386-linux-gnu/libc.so.6(__strcpy_chk+0x3f)[0xb777305f] ./mkfs.btrfs[0x805acc4] ./mkfs.btrfs[0x805def6] /lib/i386-linux-gnu/libc.so.6(__libc_start_main+0xe7)[0xb76a5e37] ./mkfs.btrfs[0x8048ef1] ======= Memory map: ======== ...... a tiny patch could fix it. Signed-off-by: Jie Liu --- mkfs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'mkfs.c') diff --git a/mkfs.c b/mkfs.c index 2ad180a1..2a11af5c 100644 --- a/mkfs.c +++ b/mkfs.c @@ -342,9 +342,9 @@ static char *parse_label(char *input) int i; int len = strlen(input); - if (len > BTRFS_LABEL_SIZE) { + if (len >= BTRFS_LABEL_SIZE) { fprintf(stderr, "Label %s is too long (max %d)\n", input, - BTRFS_LABEL_SIZE); + BTRFS_LABEL_SIZE - 1); exit(1); } for (i = 0; i < len; i++) { -- cgit v1.2.3