X-Git-Url: https://git.ozlabs.org/?p=ccan;a=blobdiff_plain;f=ccan%2Ftdb2%2Fcheck.c;h=42f7538edf97a899d9a3758b78c3ec59bf1c2dfb;hp=e39e50837d31c92de88de9efe85d574fdfc8af2e;hb=cb399d268c839dd75a59678268f3ba666147cc20;hpb=ebdd6451e2d7aa185e62a59fa2c72ffe36772d9a

diff --git a/ccan/tdb2/check.c b/ccan/tdb2/check.c
index e39e5083..42f7538e 100644
--- a/ccan/tdb2/check.c
+++ b/ccan/tdb2/check.c
@@ -71,8 +71,8 @@ static bool check_header(struct tdb_context *tdb)
 	    < tdb->map_size) {
 		tdb->log(tdb, TDB_DEBUG_ERROR, tdb->log_priv,
 			 "check: %llu zones size %llu don't cover %llu\n",
-			 (long long)(1ULL << tdb->header.v.zone_bits),
 			 (long long)tdb->header.v.num_zones,
+			 (long long)(1ULL << tdb->header.v.zone_bits),
 			 (long long)tdb->map_size);
 		return false;
 	}
@@ -86,8 +86,8 @@ static bool check_header(struct tdb_context *tdb)
 static int off_cmp(const tdb_off_t *a, const tdb_off_t *b)
 {
 	/* Can overflow an int. */
-	return a > b ? 1
-		: a < b ? -1
+	return *a > *b ? 1
+		: *a < *b ? -1
 		: 0;
 }
 
@@ -372,6 +372,14 @@ int tdb_check(struct tdb_context *tdb,
 			if (tdb->methods->oob(tdb, off + len, false))
 				goto fail;
 
+			if (len < sizeof(p->f)) {
+				tdb->log(tdb, TDB_DEBUG_ERROR, tdb->log_priv,
+					 "tdb_check: too short record %llu at"
+					 " %llu\n",
+					 (long long)len, (long long)off);
+				goto fail;
+			}
+
 			if (off + sizeof(p->u) == tdb->header.v.hash_off) {
 				hash_found = true;
 			} else if (off + sizeof(p->u)