astelm/minio
1
0
Fork 0
mirror of https://github.com/pgsty/minio.git synced 2026-08-09 07:43:29 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(storage): reject unusable erasure metadata at every sink

Browse Source 
Malformed erasure layouts can divide by zero, while negative part sizes collapse expected shard sizes to zero and make truncated data appear healthy. Boundary validation alone is insufficient because poisoned metadata may already exist on disk or arrive through local heal paths.

Reject non-positive block sizes at the sole Erasure constructor, guard the metadata arithmetic helpers and rebalance calculation, refuse negative part sizes before persistence, and make CheckParts and VerifyFile reject previously stored poison. Tests cover both shard-size implementations, construction, persistence, local verification, and the wire boundary.

Co-authored-by: ChatGPT <noreply@openai.com>
Co-authored-by: Claude <noreply@anthropic.com>
This commit is contained in:
Feng Ruohang
2026-08-04 22:41:50 +08:00
parent ca7baa670d
commit 80e8eaa423
6 changed files with 146 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/xl-storage.go
+12
View File
@@ -2423,6 +2423,12 @@ func (s *xlStorage) CheckParts(ctx context.Context, volume string, path string,
return nil, err
}
// Already-persisted metadata can carry this even though the boundary now
// refuses it, so the check belongs here too, not only at the wire edge.
if fi.HasNegativePartSize() {
return nil, errFileCorrupt
}
resp := CheckPartsResp{
// By default, all results have an unknown status
Results: make([]int, len(fi.Parts)),
@@ -3126,6 +3132,12 @@ func (s *xlStorage) VerifyFile(ctx context.Context, volume, path string, fi File
}
}
// See CheckParts: metadata already on disk can carry this even though the
// boundary now refuses it.
if fi.HasNegativePartSize() {
return nil, errFileCorrupt
}
resp := CheckPartsResp{
// By default, the result is unknown per part
Results: make([]int, len(fi.Parts)),