openharmony/third_party_f2fs-tools
1
0
Fork 0
mirror of https://gitee.com/openharmony/third_party_f2fs-tools synced 2024-11-23 01:59:54 +00:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

fsck.f2fs: sanity check cp_payload before reading checkpoint

Browse Source 
cp_payload is not sanity checked from input image. A invalid size
can cause buffer overflow when reading checkpoint blks into memory.

Signed-off-by: Jin Qian <jinqian@google.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
This commit is contained in:
Jin Qian 2017-04-27 12:12:22 -07:00 committed by Jaegeuk Kim
parent d87fc37b02
commit b79c3ba4ea
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
fsck/mount.c
View File

@ -594,9 +594,14 @@ int get_valid_checkpoint(struct f2fs_sb_info *sbi)
unsigned long blk_size = sbi->blocksize;
unsigned long long cp1_version = 0, cp2_version = 0, version;
unsigned long long cp_start_blk_no;
unsigned int cp_blks = 1 + get_sb(cp_payload);
unsigned int cp_payload, cp_blks;
int ret;
cp_payload = get_sb(cp_payload);
if (cp_payload > F2FS_BLK_ALIGN(MAX_SIT_BITMAP_SIZE))
return -EINVAL;
cp_blks = 1 + cp_payload;
sbi->ckpt = malloc(cp_blks * blk_size);
if (!sbi->ckpt)
return -ENOMEM;