Details
-
Bug
-
Resolution: Fixed
-
Major
Description
write_file2() expects a pointer to ULONG as a param.However target.length is a USHORT.
So right now the call to write_file2() is casting the pointer to a ULONG:
write_file2( ,(ULONG*)&target.length,);
When derreferencing such pointer, we will try to read memory adjacent to the USHORT that we shouldnt.
The solution proposed in the patch is to store the USHORT into an ULONG middleware variable and then sending this ULONG pointer.
I have the BTRFS git checked out so I can send it upstream if correct.