[Bug 899243] [NEW] [fsck.minix ] segfault while recovering directory with lots of files

[Joao Carreira]

Public bug reported:

fsck.minix (version V2) crashes when recovering a directory containing a
high number of files (e.g., 9000 dummy files).

fsck.minix wrongly determines when a block is pointed by a triple
indirect pointer, in the following line (in map_block2 function):

if (blknr >= 256 * 256) // this should be blknr <= 256 * 256

This error leads to a negative block number which leads to a wrong
memory access and to a segmentation fault.

I have attached a patch that fixes the problem. I can provide a sample
disk that exercises the error.

** Affects: util-linux (Ubuntu)
     Importance: Undecided
         Status: New


** Tags: fsck.minix segfault v2

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to util-linux in Ubuntu.
https://bugs.launchpad.net/bugs/899243

Title:
  [fsck.minix ] segfault while recovering directory with lots  of files

Status in “util-linux” package in Ubuntu:
  New

Bug description:
  fsck.minix (version V2) crashes when recovering a directory containing
  a high number of files (e.g., 9000 dummy files).

  fsck.minix wrongly determines when a block is pointed by a triple
  indirect pointer, in the following line (in map_block2 function):

  if (blknr >= 256 * 256) // this should be blknr <= 256 * 256

  This error leads to a negative block number which leads to a wrong
  memory access and to a segmentation fault.

  I have attached a patch that fixes the problem. I can provide a sample
  disk that exercises the error.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/util-linux/+bug/899243/+subscriptions