From: Artem Blagodarenko Date: Sat, 4 Nov 2017 17:22:18 +0000 (+0300) Subject: e2fsck: fix access after free for dx_db structure X-Git-Tag: v1.43.8~24 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=354545a7cf91d4f0a71ad1f594008a6c4fbad80d;p=thirdparty%2Fe2fsprogs.git e2fsck: fix access after free for dx_db structure dx_db structure is freed after fixing of PR_2_HTREE_BAD_ROOT problem. Next code block use this structure to unerstand if leaf is beeng processed. If dx_db is freed, then root block is being processed and if_leaf need to be set to 0. Signed-off-by: Artem Blagodarenko Signed-off-by: Theodore Ts'o Reviewed-by: Andreas Dilger --- diff --git a/e2fsck/pass2.c b/e2fsck/pass2.c index 7190c9772..d931a87e8 100644 --- a/e2fsck/pass2.c +++ b/e2fsck/pass2.c @@ -1062,7 +1062,7 @@ inline_read_fail: fix_problem(ctx, PR_2_HTREE_BAD_ROOT, &cd->pctx)) { clear_htree(ctx, ino); dx_dir->numblocks = 0; - dx_db = 0; + dx_db = NULL; } dx_dir->hashversion = root->hash_version; if ((dx_dir->hashversion <= EXT2_HASH_TEA) && @@ -1074,9 +1074,10 @@ inline_read_fail: (ext2fs_dirent_name_len(dirent) == 0) && (ext2fs_le16_to_cpu(limit->limit) == ((fs->blocksize - (8 + dx_csum_size)) / - sizeof(struct ext2_dx_entry)))) + sizeof(struct ext2_dx_entry)))) { dx_db->type = DX_DIRBLOCK_NODE; - is_leaf = (dx_db->type == DX_DIRBLOCK_LEAF); + } + is_leaf = dx_db ? (dx_db->type == DX_DIRBLOCK_LEAF) : 0; } out_htree: