Archive-Team
/
zfs
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 103 Wiki Activity

zdb: segfault in dump_bpobj_subobjs() 

Avoid buffer overrun on all-zero bpobj subobjects by using signed
array index.  Also fix the type cast on the printf() argument.

Signed-off-by: Tim Chase <tim@onlight.com>
Signed-off-by: Brian Behlendorf <behlendorf1@llnl.gov>
Closes #3905
This commit is contained in:
Tim Chase 2015-10-09 13:28:12 -05:00 committed by Brian Behlendorf
parent 385f9691c4
commit 2986b3fd25
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
cmd/zdb/zdb.c
View File

@ -469,7 +469,7 @@ static void
dump_bpobj_subobjs(objset_t *os, uint64_t object, void *data, size_t size) dump_bpobj_subobjs(objset_t *os, uint64_t object, void *data, size_t size)
{ {
dmu_object_info_t doi; dmu_object_info_t doi;
uint64_t i; int64_t i;
VERIFY0(dmu_object_info(os, object, &doi)); VERIFY0(dmu_object_info(os, object, &doi));
uint64_t *subobjs = kmem_alloc(doi.doi_max_offset, KM_SLEEP); uint64_t *subobjs = kmem_alloc(doi.doi_max_offset, KM_SLEEP);
@ -488,7 +488,7 @@ dump_bpobj_subobjs(objset_t *os, uint64_t object, void *data, size_t size)
} }
for (i = 0; i <= last_nonzero; i++) { for (i = 0; i <= last_nonzero; i++) {
(void) printf("\t%llu\n", (longlong_t)subobjs[i]); (void) printf("\t%llu\n", (u_longlong_t)subobjs[i]);
} }
kmem_free(subobjs, doi.doi_max_offset); kmem_free(subobjs, doi.doi_max_offset);
} }