[LU-4161] e2image -I has malloc corruption in write_bitmaps

Mon, 10 Feb 2014 02:35:20 +0000

For ~~LU-3542~~ I was trying to use e2image to get the sparse image of some OSTs, but was still having issues with the size of the files. I tried moving the sparse image to another machine and expanding it on a loopback device, but got malloc corruption when using -I. I tracked it down to a buffer overflow in write_bitmaps:

...
		retval = io_channel_alloc_buf(fs->io, 0, &block_buf);
		if (retval)
			goto errout;
		memset(block_buf, 0xff, fs->blocksize);
...

Basically, the io->block_size is 1024, so alloc_buf creates a 1k buffer but then memset writes out 4k. I changed it to:

                retval = io_channel_alloc_buf(fs->io, fs->blocksize / fs->io->block_size, &block_buf);

e2image -I still doesn't work for me for some reason, but it doesn't hit the malloc

Whamcloud Community JIRA

[LU-4161] e2image -I has malloc corruption in write_bitmaps