Commit fbc32615 authored by Su Yue's avatar Su Yue Committed by David Sterba

btrfs: Verify dir_item in iterate_object_props

Call verify_dir_item before memcmp_extent_buffer reading name from
dir_item.
Signed-off-by: default avatarSu Yue <suy.fnst@cn.fujitsu.com>
Reviewed-by: default avatarDavid Sterba <dsterba@suse.com>
Signed-off-by: default avatarDavid Sterba <dsterba@suse.com>
parent 64c7b014
...@@ -164,6 +164,7 @@ static int iterate_object_props(struct btrfs_root *root, ...@@ -164,6 +164,7 @@ static int iterate_object_props(struct btrfs_root *root,
size_t), size_t),
void *ctx) void *ctx)
{ {
struct btrfs_fs_info *fs_info = root->fs_info;
int ret; int ret;
char *name_buf = NULL; char *name_buf = NULL;
char *value_buf = NULL; char *value_buf = NULL;
...@@ -214,6 +215,12 @@ static int iterate_object_props(struct btrfs_root *root, ...@@ -214,6 +215,12 @@ static int iterate_object_props(struct btrfs_root *root,
name_ptr = (unsigned long)(di + 1); name_ptr = (unsigned long)(di + 1);
data_ptr = name_ptr + name_len; data_ptr = name_ptr + name_len;
if (verify_dir_item(fs_info, leaf,
path->slots[0], di)) {
ret = -EIO;
goto out;
}
if (name_len <= XATTR_BTRFS_PREFIX_LEN || if (name_len <= XATTR_BTRFS_PREFIX_LEN ||
memcmp_extent_buffer(leaf, XATTR_BTRFS_PREFIX, memcmp_extent_buffer(leaf, XATTR_BTRFS_PREFIX,
name_ptr, name_ptr,
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment