There is an off-by-one error in dx_grow_tree() when checking whether we can add another level to the tree. Thus we can grow tree too much leading to possible crashes in the library or corrupted filesystem. Fix the bug. Signed-off-by: Jan Kara <jack@xxxxxxx> --- lib/ext2fs/link.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/ext2fs/link.c b/lib/ext2fs/link.c index 7b5bb022117c..469eea8cd06d 100644 --- a/lib/ext2fs/link.c +++ b/lib/ext2fs/link.c @@ -473,7 +473,7 @@ static errcode_t dx_grow_tree(ext2_filsys fs, ext2_ino_t dir, ext2fs_le16_to_cpu(info->frames[i].head->limit)) break; /* Need to grow tree depth? */ - if (i < 0 && info->levels > ext2_dir_htree_level(fs)) + if (i < 0 && info->levels >= ext2_dir_htree_level(fs)) return EXT2_ET_DIR_NO_SPACE; lblk = size / fs->blocksize; size += fs->blocksize; -- 2.16.4
