astelm/minio
1
0
Fork 0
mirror of https://github.com/pgsty/minio.git synced 2026-08-09 15:53:28 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(storage): reject unusable erasure metadata at every sink

Browse Source 
Malformed erasure layouts can divide by zero, while negative part sizes collapse expected shard sizes to zero and make truncated data appear healthy. Boundary validation alone is insufficient because poisoned metadata may already exist on disk or arrive through local heal paths.

Reject non-positive block sizes at the sole Erasure constructor, guard the metadata arithmetic helpers and rebalance calculation, refuse negative part sizes before persistence, and make CheckParts and VerifyFile reject previously stored poison. Tests cover both shard-size implementations, construction, persistence, local verification, and the wire boundary.

Co-authored-by: ChatGPT <noreply@openai.com>
Co-authored-by: Claude <noreply@anthropic.com>
This commit is contained in:
Feng Ruohang
2026-08-04 22:41:50 +08:00
parent ca7baa670d
commit 80e8eaa423
6 changed files with 146 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/erasure-metadata.go
+8
View File
@@ -58,6 +58,14 @@ func (e ErasureInfo) ShardFileSize(totalLength int64) int64 {
if totalLength == -1 {
return -1
}
// ErasureInfo can arrive zero-valued from an untrusted internode payload:
// CheckParts and VerifyFile hand a wire-supplied FileInfo straight here.
// A zero BlockSize would panic with an integer divide-by-zero, and
// CheckParts evaluates this inside xioutil.WithDeadline - a bare goroutine
// whose panic no recover() can reach, taking the whole process down.
if e.BlockSize <= 0 || e.DataBlocks <= 0 {
return 0
}
numShards := totalLength / e.BlockSize
lastBlockSize := totalLength % e.BlockSize
lastShardSize := ceilFrac(lastBlockSize, int64(e.DataBlocks))