From: Darrick J. Wong Date: Fri, 18 Jul 2014 22:54:15 +0000 (-0700) Subject: e2fsck: don't crash during rehash X-Git-Tag: v1.42.12~71 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c23b2cc439a042b1e58eef3eb09668d3f7349600;p=thirdparty%2Fe2fsprogs.git e2fsck: don't crash during rehash If a user crafts a carefully constructed filesystem containing a single directory entry block with an invalid checksum and fewer than two entries, and then runs e2fsck to fix the filesystem, fsck will crash when it tries to "compress" the short dir and passes a negative dirent array length to qsort. Therefore, don't allow directory "compression" in this situation. Signed-off-by: Darrick J. Wong Signed-off-by: Theodore Ts'o --- diff --git a/e2fsck/rehash.c b/e2fsck/rehash.c index 276962245..e80ed3ad8 100644 --- a/e2fsck/rehash.c +++ b/e2fsck/rehash.c @@ -770,7 +770,7 @@ retry_nohash: /* Sort the list */ resort: - if (fd.compress) + if (fd.compress && fd.num_array > 1) qsort(fd.harray+2, fd.num_array-2, sizeof(struct hash_entry), hash_cmp); else @@ -789,7 +789,7 @@ resort: } /* Sort non-hashed directories by inode number */ - if (fd.compress) + if (fd.compress && fd.num_array > 1) qsort(fd.harray+2, fd.num_array-2, sizeof(struct hash_entry), ino_cmp);