From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Alex Shumsky Date: Mon, 14 Jun 2024 19:01:48 +0000 Subject: fs/btrfs: fix out of bounds write Signed-off-by: Alex Shumsky --- fs/btrfs/inode.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c index 4691612eda..b51f578b49 100644 --- a/fs/btrfs/inode.c +++ b/fs/btrfs/inode.c @@ -638,11 +638,11 @@ static int read_and_truncate_page(struct btrfs_path *path, return -ENOMEM; extent_type = btrfs_file_extent_type(leaf, fi); if (extent_type == BTRFS_FILE_EXTENT_INLINE) { ret = btrfs_read_extent_inline(path, fi, buf); - memcpy(dest, buf + page_off, min(page_len, ret)); + memcpy(dest, buf + page_off, min(min(page_len, ret), len)); free(buf); return len; } ret = btrfs_read_extent_reg(path, fi, @@ -650,11 +650,11 @@ static int read_and_truncate_page(struct btrfs_path *path, fs_info->sectorsize, buf); if (ret < 0) { free(buf); return ret; } - memcpy(dest, buf + page_off, page_len); + memcpy(dest, buf + page_off, min(page_len, len)); free(buf); return len; } int btrfs_file_read(struct btrfs_root *root, u64 ino, u64 file_offset, u64 len, -- Created with Armbian build tools https://github.com/armbian/build