e2fsck: don't crash during rehash

If a user crafts a carefully constructed filesystem containing a
single directory entry block with an invalid checksum and fewer than
two entries, and then runs e2fsck to fix the filesystem, fsck will
crash when it tries to "compress" the short dir and passes a negative
dirent array length to qsort.  Therefore, don't allow directory
"compression" in this situation.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>

diff --git a/e2fsck/rehash.c b/e2fsck/rehash.c
index 2769622458883289b1237bef8bade427bff3909c..e80ed3ad8237443ac8f5a27ead49aa1b8432b2ac 100644 (file)
--- a/e2fsck/rehash.c
+++ b/e2fsck/rehash.c
@@ -770,7 +770,7 @@ retry_nohash:
 
        /* Sort the list */
 resort:
-       if (fd.compress)
+       if (fd.compress && fd.num_array > 1)
                qsort(fd.harray+2, fd.num_array-2, sizeof(struct hash_entry),
                      hash_cmp);
        else
@@ -789,7 +789,7 @@ resort:
        }
 
        /* Sort non-hashed directories by inode number */
-       if (fd.compress)
+       if (fd.compress && fd.num_array > 1)
                qsort(fd.harray+2, fd.num_array-2,
                      sizeof(struct hash_entry), ino_cmp);