Kernel/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2024-12-28 16:53:49 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

fs/ntfs3: Add more checks in mi_enum_attr (part 2)

Browse Source 
Add offset check before access to attr->non_res field as mentioned in [1].

[1] https://lore.kernel.org/ntfs3/20241010110005.42792-1-llfamsec@gmail.com/

Suggested-by: lei lu <llfamsec@gmail.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
This commit is contained in:
Konstantin Komarov 2024-10-21 14:49:01 +03:00
parent 045fff6193
commit a8f659ce14
No known key found for this signature in database
GPG Key ID: A9B0331F832407B6
1 changed files with 13 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
fs/ntfs3/record.c
View File

@ -212,7 +212,7 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr)
return NULL;
if (off >= used || off < MFTRECORD_FIXUP_OFFSET_1 ||
!IS_ALIGNED(off, 4)) {
!IS_ALIGNED(off, 8)) {
return NULL;
}
@ -236,8 +236,11 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr)
off += asize;
}
/* Can we use the first field (attr->type). */
/* NOTE: this code also checks attr->size availability. */
/*
* Can we use the first fields:
* attr->type,
* attr->size
*/
if (off + 8 > used) {
static_assert(ALIGN(sizeof(enum ATTR_TYPE), 8) == 8);
return NULL;
@ -259,10 +262,17 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr)
asize = le32_to_cpu(attr->size);
if (!IS_ALIGNED(asize, 8))
return NULL;
/* Check overflow and boundary. */
if (off + asize < off || off + asize > used)
return NULL;
/* Can we use the field attr->non_res. */
if (off + 9 > used)
return NULL;
/* Check size of attribute. */
if (!attr->non_res) {
/* Check resident fields. */