mirror of
https://github.com/versity/scoutfs.git
synced 2026-07-21 23:42:23 +00:00
Auke Kok
9fb0869535
Scoutfs print segfaults walking a log_merge btree that has more than one level. print_btree_block() prints parent (level > 0) items via print_block_ref(), which invokes the item callback with a NULL value to print the key portion before printing the child ref: func(key, 0, 0, NULL, 0, arg); print_log_merge_item immediately casts val and reads a field, dereferencing NULL. A log_merge of a single leaf block (height 1) never hits the parent path; one with height > 1 crashes on the first parent item: scoutfs[22043]: segfault at 8 ip 0000000000408ef0 sp 00007fffc5edd8b0 error 4 #0 0x0000000000408ef0 in print_log_merge_item () #1 0x000000000040958d in print_btree_block.constprop.0.isra () #2 0x000000000040a471 in print_cmd () #3 0x0000000000404264 in cmd_execute () #4 0x00000000004025c9 in main () print_mounted_client_entry has the same bug: it casts val and reads mcv->addr / mcv->flags with no NULL guard, so a mounted_clients btree of height > 1 segfaults the same way. print_srch_root_item guards NULL but casts to scoutfs_srch_compact or scoutfs_srch_file without bounds checking, so a short or malformed item reads past its end. Fix all three: return early when val is NULL (printing just the key for the parent ref where applicable), and bounds-check val_len before each cast so a short item is reported instead of read past its end. Signed-off-by: Auke Kok <auke.kok@versity.com>