[LU-4161] e2image -I has malloc corruption in write_bitmaps

• Type: Bug
• Resolution: Fixed
• Priority: Trivial
• Environment: Centos 5
• Severity: 3
• Assignee: Niu Yawei (Inactive)
• Reporter: Kit Westneat (Inactive)

Description

For LU-3542 I was trying to use e2image to get the sparse image of some OSTs, but was still having issues with the size of the files. I tried moving the sparse image to another machine and expanding it on a loopback device, but got malloc corruption when using -I. I tracked it down to a buffer overflow in write_bitmaps:

...
		retval = io_channel_alloc_buf(fs->io, 0, &block_buf);
		if (retval)
			goto errout;
		memset(block_buf, 0xff, fs->blocksize);
...

Basically, the io->block_size is 1024, so alloc_buf creates a 1k buffer but then memset writes out 4k. I changed it to:

                retval = io_channel_alloc_buf(fs->io, fs->blocksize / fs->io->block_size, &block_buf);

e2image -I still doesn't work for me for some reason, but it doesn't hit the malloc