From d45b67c5f2a66597d8e2915052e180203a9193b8 Mon Sep 17 00:00:00 2001 From: Jim Keniston Date: Mon, 6 Aug 2012 18:46:03 -0400 Subject: [PATCH] e2fsck: fix potential segv when handling a read error in a superblock When passed a negative count (indicating a byte count rather than a block count) e2fsck_handle_read_error() treats the data as a full block, causing unix_write_blk64() (which can handle negative counts just fine) to try to write too much. Given a faulty block device, this resulted in a SEGV when unix_write_blk64() read past the bottom of the stack copying the data to cache. (check_backup_super_block -> unix_read_blk64 -> raw_read_blk -> e2fsck_handle_read_error) Reported-by: Alex Friedman Signed-off-by: Jim Keniston Signed-off-by: Dan Streetman Reviewed-by: Mingming Cao Signed-off-by: Theodore Ts'o --- e2fsck/ehandler.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/e2fsck/ehandler.c b/e2fsck/ehandler.c index 6eecf33..6dddf9c 100644 --- a/e2fsck/ehandler.c +++ b/e2fsck/ehandler.c @@ -60,7 +60,7 @@ static errcode_t e2fsck_handle_read_error(io_channel channel, preenhalt(ctx); if (ask(ctx, _("Ignore error"), 1)) { if (ask(ctx, _("Force rewrite"), 1)) - io_channel_write_blk64(channel, block, 1, data); + io_channel_write_blk64(channel, block, count, data); return 0; } -- 1.8.3.1