From 28148f623d8deaa290674ac8173dcd0f904ca303 Mon Sep 17 00:00:00 2001 From: Eric Sandeen Date: Mon, 8 Jun 2009 16:39:32 -0500 Subject: [PATCH] xfs_repair: catch bad depth in traverse_int_dir2block A bad on-disk tree depth in traverse_int_dir2block() can later cause a segfault when it's used as an array index in this function; if we get something beyond the max depth, just error out and the dir will get rebuilt. Reported-by: Richard Kolkovich Signed-off-by: Eric Sandeen Reviewed-by: Christoph Hellwig --- repair/dir2.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/repair/dir2.c b/repair/dir2.c index 9575fb1c9..2723e3b92 100644 --- a/repair/dir2.c +++ b/repair/dir2.c @@ -339,9 +339,17 @@ traverse_int_dir2block(xfs_mount_t *mp, /* * maintain level counter */ - if (i == -1) + if (i == -1) { i = da_cursor->active = be16_to_cpu(node->hdr.level); - else { + if (i >= XFS_DA_NODE_MAXDEPTH) { + do_warn(_("bad header depth for directory " + "inode %llu\n"), + da_cursor->ino); + da_brelse(bp); + i = -1; + goto error_out; + } + } else { if (be16_to_cpu(node->hdr.level) == i - 1) { i--; } else { -- 2.39.5