[Bug 271378] negative jt_size in ffs truncate journal record causes fsck to crash

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=271378

            Bug ID: 271378
           Summary: negative jt_size in ffs truncate journal record causes
                    fsck to crash
           Product: Base System
           Version: CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Some People
          Priority: ---
         Component: bin
          Assignee: bugs@FreeBSD.org
          Reporter: rtm@lcs.mit.edu

Created attachment 242130
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=242130&action=edit
gzipped ffs image with bad journal record that causes fsck to crash in
ino_trunc

If a truncate journal record has a negative size, suj.c's ino_trunc()
will index di_db[] with a negative index here:

        lastlbn = lblkno(fs, blkroundup(fs, size));
        for (i = lastlbn; i < UFS_NDADDR; i++) {
                if ((bn = DIP(dp, di_db[i])) == 0)

I've attached a gzipped file system image; here's the backtrace
from fsck_ffs -y fsck22a.img:

Program received signal SIGSEGV, Segmentation fault.
Address not mapped to object.
0x000000000022aaca in ino_trunc (ino=3, size=-4420917493761) at suj.c:1329
1329                    if ((bn = DIP(dp, di_db[i])) == 0)
(gdb) where
#0  0x000000000022aaca in ino_trunc (ino=3, size=-4420917493761) at suj.c:1329
#1  0x00000000002270f7 in cg_trunc (sc=0x800a8a8c0) at suj.c:1574
#2  0x0000000000226dc5 in cg_apply (apply=0x227090 <cg_trunc>) at suj.c:1638
#3  0x0000000000225562 in suj_check (filesys=0x7fffffffed74 "junk")
    at suj.c:2460
#4  0x00000000002195c6 in checkfilesys (filesys=0x7fffffffed74 "junk")
    at main.c:356
#5  0x0000000000218f72 in main (argc=1, argv=0x7fffffffea20) at main.c:210

-- 
You are receiving this mail because:
You are the assignee for the bug.