d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix a read past the end of a buffer in fsck.

Browse Source 
To minimize the time spent scanning all of the directories in pass 2
(Check Pathnames), fsck uses a search order based on the location
of their first block. Zero length directories have no first block,
so the array being used to hold the block numbers of directory
inodes was of zero length. Thus a lookup was done past the end of
the array getting at best a random value and at worst a segment
fault.  For zero length directories, this change allocates a one
element block array and initializes it to zero. The effect is that
all zero length directories are handled first in pass 2.

Reviewed by: brooks
Differential Revision: https://reviews.freebsd.org/D14163
This commit is contained in:
Kirk McKusick 2018-02-21 20:32:23 +00:00
parent a5e2e5c724
commit 12487c7243
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
sbin/fsck_ffs/inode.c
View File

@ -453,8 +453,10 @@ cacheino(union dinode *dp, ino_t inumber)
if (howmany(DIP(dp, di_size), sblock.fs_bsize) > UFS_NDADDR)
blks = UFS_NDADDR + UFS_NIADDR;
else
else if (DIP(dp, di_size) > 0)
blks = howmany(DIP(dp, di_size), sblock.fs_bsize);
else
blks = 1;
inp = (struct inoinfo *)
Malloc(sizeof(*inp) + (blks - 1) * sizeof(ufs2_daddr_t));
if (inp == NULL)