Commit 3c1d4184 authored by Su Yue's avatar Su Yue Committed by David Sterba

btrfs: Check name_len in btrfs_check_ref_name_override

In btrfs_log_inode, btrfs_search_forward gets the buffer and then
btrfs_check_ref_name_override will read name from ref/extref for the
first time.

Call btrfs_is_name_len_valid before reading name.
Signed-off-by: default avatarSu Yue <suy.fnst@cn.fujitsu.com>
Reviewed-by: default avatarDavid Sterba <dsterba@suse.com>
Signed-off-by: default avatarDavid Sterba <dsterba@suse.com>
parent 8ee8c2d6
...@@ -4562,6 +4562,12 @@ static int btrfs_check_ref_name_override(struct extent_buffer *eb, ...@@ -4562,6 +4562,12 @@ static int btrfs_check_ref_name_override(struct extent_buffer *eb,
this_len = sizeof(*extref) + this_name_len; this_len = sizeof(*extref) + this_name_len;
} }
ret = btrfs_is_name_len_valid(eb, slot, name_ptr,
this_name_len);
if (!ret) {
ret = -EIO;
goto out;
}
if (this_name_len > name_len) { if (this_name_len > name_len) {
char *new_name; char *new_name;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment