From d5213118a5cb36c0a5bfc14131a36650688a9094 Mon Sep 17 00:00:00 2001 From: Lu Fengqi Date: Thu, 20 Apr 2017 16:07:56 +0800 Subject: [PATCH] btrfs-progs: dump-super: check array_size in print_sys_chunk_array Without validation of array_size, the dump-super may lead to a bad memory access. Signed-off-by: Lu Fengqi Signed-off-by: David Sterba --- cmds-inspect-dump-super.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/cmds-inspect-dump-super.c b/cmds-inspect-dump-super.c index ee2c8e3..b65bd2d 100644 --- a/cmds-inspect-dump-super.c +++ b/cmds-inspect-dump-super.c @@ -65,13 +65,20 @@ static void print_sys_chunk_array(struct btrfs_super_block *sb) buf = malloc(sizeof(*buf) + sizeof(*sb)); if (!buf) { error("not enough memory"); - goto out; + return; } write_extent_buffer(buf, sb, 0, sizeof(*sb)); array_size = btrfs_super_sys_array_size(sb); array_ptr = sb->sys_chunk_array; sb_array_offset = offsetof(struct btrfs_super_block, sys_chunk_array); + + if (array_size > BTRFS_SYSTEM_CHUNK_ARRAY_SIZE) { + error("sys_array_size %u shouldn't exceed %u bytes", + array_size, BTRFS_SYSTEM_CHUNK_ARRAY_SIZE); + goto out; + } + cur_offset = 0; item = 0; @@ -124,8 +131,8 @@ static void print_sys_chunk_array(struct btrfs_super_block *sb) item++; } - free(buf); out: + free(buf); return; out_short_read: -- 2.7.4