From: Li RongQing <roy.qing...@gmail.com>
It is impossible that csum_size is larger than sizeof(long), but the codes
still add the handler for this condition, like allocate new memory, for
extension. If it becomes true someday, copying csum_size size memory to local
32bit variable found and val will overflow these two variables.
Fix it by returning the max 4 byte checksum.
Signed-off-by: Li RongQing <roy.qing...@gmail.com>
---
fs/btrfs/disk-io.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index ce8b8b6..cfa2953 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -296,6 +296,8 @@ static int csum_tree_block(struct btrfs_root *root, struct
extent_buffer *buf,
if (memcmp_extent_buffer(buf, result, 0, csum_size)) {
u32 val;
u32 found = 0;
+
+ csum_size = min_t(u16, csum_size, sizeof(u32));
memcpy(&found, result, csum_size);
read_extent_buffer(buf, &val, 0, csum_size);
--
1.7.10.4
--
To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
