RepoMirrors
/
btrfs-progs
mirror of https://github.com/kdave/btrfs-progs
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

btrfs-progs: send-stream: check command length before reading from stream 

The command + header length could not fit to the intermediate buffer.

Signed-off-by: David Sterba <dsterba@suse.com>
This commit is contained in:
David Sterba 2016-11-15 14:38:19 +01:00
parent d63854d1b6
commit 23ac27781e
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
send-stream.c
View File

@ -82,6 +82,7 @@ static int read_cmd(struct btrfs_send_stream *sctx)
memset(sctx->cmd_attrs, 0, sizeof(sctx->cmd_attrs));
ASSERT(sizeof(*sctx->cmd_hdr) <= sizeof(sctx->read_buf));
ret = read_buf(sctx, sctx->read_buf, sizeof(*sctx->cmd_hdr));
if (ret < 0)
goto out;
@ -95,6 +96,13 @@ static int read_cmd(struct btrfs_send_stream *sctx)
cmd = le16_to_cpu(sctx->cmd_hdr->cmd);
cmd_len = le32_to_cpu(sctx->cmd_hdr->len);
if (cmd_len + sizeof(*sctx->cmd_hdr) >= sizeof(sctx->read_buf)) {
ret = -EINVAL;
error("command length %d too big for buffer %zu",
cmd_len, sizeof(sctx->read_buf));
goto out;
}
data = sctx->read_buf + sizeof(*sctx->cmd_hdr);
ret = read_buf(sctx, data, cmd_len);
if (ret < 0)