tdb2: check that records are of sufficient length in tdb_check.

diff --git a/ccan/tdb2/check.c b/ccan/tdb2/check.c
index f8abfc1fad4e30f20829e96cb6e557e0630efc45..42f7538edf97a899d9a3758b78c3ec59bf1c2dfb 100644 (file)
--- a/ccan/tdb2/check.c
+++ b/ccan/tdb2/check.c
@@ -372,6 +372,14 @@ int tdb_check(struct tdb_context *tdb,
                        if (tdb->methods->oob(tdb, off + len, false))
                                goto fail;
 
+                       if (len < sizeof(p->f)) {
+                               tdb->log(tdb, TDB_DEBUG_ERROR, tdb->log_priv,
+                                        "tdb_check: too short record %llu at"
+                                        " %llu\n",
+                                        (long long)len, (long long)off);
+                               goto fail;
+                       }
+
                        if (off + sizeof(p->u) == tdb->header.v.hash_off) {
                                hash_found = true;
                        } else if (off + sizeof(p->u)