From 309d7f1e4754ac448d8b098bd36287fa37a77475 Mon Sep 17 00:00:00 2001 From: Kota Tsuyuzaki Date: Mon, 30 Mar 2015 10:55:09 +0900 Subject: [PATCH] Fix invalid metadata handling On the current code, get_fragment_partition might touch the invlid memory area with minus index (that means a invalid header) and it causes segmentation fault. This fixes it to handle the minus index as a EBADHEADER and then no segmentaition fault appeared on the case. --- src/erasurecode.c | 5 +---- src/erasurecode_preprocessing.c | 3 +++ test/liberasurecode_test.c | 3 ++- 3 files changed, 6 insertions(+), 5 deletions(-) diff --git a/src/erasurecode.c b/src/erasurecode.c index 1544ab7..2c6a30b 100644 --- a/src/erasurecode.c +++ b/src/erasurecode.c @@ -566,10 +566,7 @@ int liberasurecode_decode(int desc, available_fragments, num_fragments, out_data, out_data_len); - if (ret == -1) { - /* Ignore - not necessarily an error - * (see fragments_to_string() in src/erasurecode_preprocessing.c) */ - } else if (ret <= 0) { + if (ret == 0) { /* We were able to get the original data without decoding! */ goto out; } diff --git a/src/erasurecode_preprocessing.c b/src/erasurecode_preprocessing.c index a9a7b55..d8da1f6 100644 --- a/src/erasurecode_preprocessing.c +++ b/src/erasurecode_preprocessing.c @@ -224,6 +224,9 @@ int get_fragment_partition( */ for (i = 0; i < num_fragments; i++) { index = get_fragment_idx(fragments[i]); + if (index < 0){ + return -EBADHEADER; + } if (index < k) { data[index] = fragments[i]; } else { diff --git a/test/liberasurecode_test.c b/test/liberasurecode_test.c index d1ad516..83fa072 100644 --- a/test/liberasurecode_test.c +++ b/test/liberasurecode_test.c @@ -434,7 +434,8 @@ static void test_decode_invalid_args() rc = liberasurecode_decode(desc, avail_frags, num_avail_frags, strlen(fake_data), 1, &decoded_data, &decoded_data_len); - assert(rc == -EBADHEADER); + // force_metadata_checks results in EINSUFFFRAGS + assert(rc == -EINSUFFFRAGS); // test with num_fragments < (k) num_avail_frags = create_fake_frags_no_meta(&avail_frags, (null_args.k - 1),