Whamcloud - gitweb
libext2fs: don't corrupt an blkmap64_rb when marking a range of size zero
authorTheodore Ts'o <tytso@mit.edu>
Fri, 22 Jun 2018 14:46:52 +0000 (10:46 -0400)
committerTheodore Ts'o <tytso@mit.edu>
Fri, 22 Jun 2018 15:26:15 +0000 (11:26 -0400)
commit8b5273d5d10d180d981381353d2c88fee5744a2d
tree1fffe68d3e2524546da9de90feba24522ec130b1
parenta691f8d844faca28524b7c55780873244a070be7
libext2fs: don't corrupt an blkmap64_rb when marking a range of size zero

Calling ext2fs_mark_block_bitmap_range2() with a count of zero can end
up corrupting the red-black block bitmap structure, since a an entry
in the rbtree with zero-length extent can end up causing the
find_first_{zero,set} operations to return incorrect results.

This was found by Adam Buchbinder, who created a fuzzed file system
using which AFL that caused e2fsck to hang in an infinite loop in in
e2fsck's readahead code.

Added a regression test to detect this failure.

Signed-off-by: Theodore Ts'o <tytso@mit.edu>
lib/ext2fs/blkmap64_rb.c
lib/ext2fs/tst_bitmaps_cmds
lib/ext2fs/tst_bitmaps_exp