cluster: RHEL510 - libgfs2: Fix null pointer dereference in linked_leaf_search

Bob Peterson rpeterso at fedoraproject.org
Fri Apr 5 13:46:39 UTC 2013


Gitweb:        http://git.fedorahosted.org/git/?p=cluster.git;a=commitdiff;h=c77cd8fe7f7cd7b96106fde4ea6a411208f3a6e5
Commit:        c77cd8fe7f7cd7b96106fde4ea6a411208f3a6e5
Parent:        b2d1e993d3688ccae39a1680615c425953662861
Author:        Bob Peterson <rpeterso at redhat.com>
AuthorDate:    Thu Jan 12 15:31:18 2012 -0600
Committer:     Bob Peterson <rpeterso at redhat.com>
CommitterDate: Fri Apr 5 06:25:01 2013 -0700

libgfs2: Fix null pointer dereference in linked_leaf_search

Fix a null pointer dereference by checking the value of the bh set by
get_first_leaf(). Looking down the call tree the bh is set to NULL when
__bread fails to allocate memory so we can use errno as the return value
here.

rhbz#877150
---
 gfs2/fsck/lost_n_found.c |    3 +--
 gfs2/libgfs2/fs_ops.c    |    2 ++
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/gfs2/fsck/lost_n_found.c b/gfs2/fsck/lost_n_found.c
index c0de5d5..b2ad2d3 100644
--- a/gfs2/fsck/lost_n_found.c
+++ b/gfs2/fsck/lost_n_found.c
@@ -124,8 +124,7 @@ int add_inode_to_lf(struct gfs2_inode *ip){
 		lf_dip = createi(sdp->md.rooti, "lost+found",
 				 S_IFDIR | 0700, 0);
 		if (lf_dip == NULL) {
-			log_crit(_("Error %d creating lost+found: %s\n"),
-				 errno);
+			log_crit(_("Error %d creating lost+found\n"), errno);
 			exit(FSCK_ERROR);
 		}
 
diff --git a/gfs2/libgfs2/fs_ops.c b/gfs2/libgfs2/fs_ops.c
index 4e23b4a..1c20e61 100644
--- a/gfs2/libgfs2/fs_ops.c
+++ b/gfs2/libgfs2/fs_ops.c
@@ -1433,6 +1433,8 @@ static int linked_leaf_search(struct gfs2_inode *dip, const char *filename,
 	error = get_first_leaf(dip, lindex, &bh_next);
 	if (error)
 		return error;
+	if (bh_next == NULL)
+		return errno;
 
 	/*  Find the entry  */
 	do{


More information about the cluster-commits mailing list