> >>
> >> Are you able to reproduce the error with the version of cryptsetup that
> >> is currently in unstable?
> >
> >I can reproduce the bug using the cryptsetup from unstable. I've also
> > tried it on another machine with the same results.
>
> Ok, could you then provide me with the exact steps that you took to
> reproduce it cause so far I haven't managed to do so.
I think I've found the problem. In lib/utils.c, the sector_size function is
this:
static int sector_size(int fd)
{
int bsize;
ioctl(fd,BLKSSZGET, &bsize);
return bsize;
}
For a file, the ioctl will fail. Since bsize is not initialized, it's value
will be random (when I ran it under gdb, I got several million) and as this
value will later be used to allocate a buffer, this explains the runaway
memory allocation I saw, but you didn't.
The attached patch checks the return code from ioctl and returns -EINVAL if it
fails. The users of sector_size are also changed to abort if sector_size
returns a negative value.
With this patch applied, I get the appropriate error messages from cryptsetup
if I give it a file instead of a block device.
Regards
Rob
--- cryptsetup-1.0.4.orig/lib/utils.c 2006-10-04 14:47:01.000000000 +0100
+++ cryptsetup-1.0.4/lib/utils.c 2006-12-20 09:57:50.000000000 +0000
@@ -151,8 +151,10 @@
static int sector_size(int fd)
{
int bsize;
- ioctl(fd,BLKSSZGET, &bsize);
- return bsize;
+ if (ioctl(fd,BLKSSZGET, &bsize) < 0)
+ return -EINVAL;
+ else
+ return bsize;
}
int sector_size_for_device(const char *device)
@@ -173,6 +175,9 @@
int r;
int hangover; int solid; int bsize = sector_size(fd);
+ if (bsize < 0)
+ return bsize;
+
hangover = count % bsize;
solid = count - hangover;
@@ -211,6 +216,9 @@
int step;
int bsize = sector_size(fd);
+ if (bsize < 0)
+ return bsize;
+
padbuf = aligned_malloc(&padbuf_base, bsize, bsize);
if(padbuf == NULL) return -ENOMEM;
@@ -242,6 +250,9 @@
int frontHang = offset % bsize;
int r;
+ if (bsize < 0)
+ return bsize;
+
lseek(fd, offset - frontHang, SEEK_SET);
if(offset % bsize) {
int innerCount = count<bsize?count:bsize;
