libext2fs: don't corrupt an blkmap64_rb when marking a range of size zero
Calling ext2fs_mark_block_bitmap_range2() with a count of zero can end
up corrupting the red-black block bitmap structure, since a an entry
in the rbtree with zero-length extent can end up causing the
find_first_{zero,set} operations to return incorrect results.
This was found by Adam Buchbinder, who created a fuzzed file system
using which AFL that caused e2fsck to hang in an infinite loop in in
e2fsck's readahead code.
Added a regression test to detect this failure.
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
3 files changed