btrfs-progs: more sanity checks in read_tree_block_fs_info

If blocksize is 0, it passes the IS_ALIGNED check but fails later as the
length of ebs will be zero.

Reported-by: Lukas Lueg <lukas.lueg@gmail.com>
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=169311
Signed-off-by: David Sterba <dsterba@suse.com>

diff --git a/disk-io.c b/disk-io.c
index 29d22fb..bfc2879 100644 (file)
--- a/disk-io.c
+++ b/disk-io.c
@@ -326,16 +326,17 @@ struct extent_buffer* read_tree_block_fs_info(
         * Such unaligned tree block will free overlapping extent buffer,
         * causing use-after-free bugs for fuzzed images.
         */
-       if (!IS_ALIGNED(bytenr, sectorsize)) {
+       if (bytenr < sectorsize || !IS_ALIGNED(bytenr, sectorsize)) {
                error("tree block bytenr %llu is not aligned to sectorsize %u",
                      bytenr, sectorsize);
                return ERR_PTR(-EIO);
        }
-       if (!IS_ALIGNED(blocksize, nodesize)) {
+       if (blocksize < nodesize || !IS_ALIGNED(blocksize, nodesize)) {
                error("tree block size %u is not aligned to nodesize %u",
                      blocksize, nodesize);
                return ERR_PTR(-EIO);
        }
+
        eb = btrfs_find_create_tree_block(fs_info, bytenr, blocksize);
        if (!eb)
                return ERR_PTR(-ENOMEM);