Package: e2fsprogs
Version: 1.43.5-1

$ gzip -d get_qid-oob.ext2.gz
$ valgrind /sbin/e2fsck -f -y get_qid-oob.ext2 > /dev/null
==1251== Memcheck, a memory error detector
==1251== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==1251== Using Valgrind-3.13.0 and LibVEX; rerun with -h for copyright info
==1251== Command: /sbin/e2fsck -f -y get_qid-oob.ext2
==1251==
e2fsck 1.43.5 (04-Aug-2017)
==1251== Invalid read of size 2
==1251==    at 0x1394A2: get_qid (mkquota.c:261)
==1251==    by 0x1394A2: quota_data_inodes (mkquota.c:447)
==1251==    by 0x1296BD: disconnect_inode (pass4.c:65)
==1251==    by 0x1296BD: e2fsck_pass4 (pass4.c:161)
==1251==    by 0x117057: e2fsck_run (e2fsck.c:237)
==1251==    by 0x11274C: main (unix.c:1804)
==1251==  Address 0x4b24100 is 0 bytes after a block of size 128 alloc'd
==1251==    at 0x4830256: calloc (in 
/usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)
==1251==    by 0x12E280: e2fsck_allocate_memory (util.c:128)
==1251==    by 0x129009: e2fsck_pass4 (pass4.c:129)
==1251==    by 0x117057: e2fsck_run (e2fsck.c:237)
==1251==    by 0x11274C: main (unix.c:1804)
...


Found using American Fuzzy Lop:
http://lcamtuf.coredump.cx/afl/

-- System Information:
Architecture: i386

Versions of packages e2fsprogs depends on:
ii  e2fslibs    1.43.5-1
ii  libblkid1   2.29.2-2
ii  libc6       2.24-14
ii  libcomerr2  1.43.5-1
ii  libss2      1.43.5-1
ii  libuuid1    2.29.2-2
ii  util-linux  2.29.2-2

--
Jakub Wilk

Attachment: get_qid-oob.ext2.gz
Description: application/gzip

Reply via email to