|
 |
ec15cf |
commit 49d0fe2a14f2a23da2fe299643379b8c1d37df73
|
|
|
ec15cf |
Author: Theodore Ts'o <tytso@mit.edu>
|
|
|
ec15cf |
Date: Fri Feb 6 12:46:39 2015 -0500
|
|
|
ec15cf |
|
|
|
ec15cf |
libext2fs: fix potential buffer overflow in closefs()
|
|
|
ec15cf |
|
|
|
ec15cf |
The bug fix in f66e6ce4446: "libext2fs: avoid buffer overflow if
|
|
|
ec15cf |
s_first_meta_bg is too big" had a typo in the fix for
|
|
|
ec15cf |
ext2fs_closefs(). In practice most of the security exposure was from
|
|
|
ec15cf |
the openfs path, since this meant if there was a carefully crafted
|
|
|
ec15cf |
file system, buffer overrun would be triggered when the file system was
|
|
|
ec15cf |
opened.
|
|
|
ec15cf |
|
|
|
ec15cf |
However, if corrupted file system didn't trip over some corruption
|
|
|
ec15cf |
check, and then the file system was modified via tune2fs or debugfs,
|
|
|
ec15cf |
such that the superblock was marked dirty and then written out via the
|
|
|
ec15cf |
closefs() path, it's possible that the buffer overrun could be
|
|
|
ec15cf |
triggered when the file system is closed.
|
|
|
ec15cf |
|
|
|
ec15cf |
Also clear up a signed vs unsigned warning while we're at it.
|
|
|
ec15cf |
|
|
|
ec15cf |
Thanks to Nick Kralevich <nnk@google.com> for asking me to look at
|
|
|
ec15cf |
compiler warning in the code in question, which led me to notice the
|
|
|
ec15cf |
bug in f66e6ce4446.
|
|
|
ec15cf |
|
|
|
ec15cf |
Addresses: CVE-2015-1572
|
|
|
ec15cf |
|
|
|
ec15cf |
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
|
|
|
ec15cf |
|
|
|
ec15cf |
Index: e2fsprogs-1.42.9/lib/ext2fs/closefs.c
|
|
|
ec15cf |
===================================================================
|
|
|
ec15cf |
--- e2fsprogs-1.42.9.orig/lib/ext2fs/closefs.c
|
|
|
ec15cf |
+++ e2fsprogs-1.42.9/lib/ext2fs/closefs.c
|
|
|
ec15cf |
@@ -279,7 +279,7 @@ errcode_t ext2fs_flush2(ext2_filsys fs,
|
|
|
ec15cf |
dgrp_t j;
|
|
|
ec15cf |
#endif
|
|
|
ec15cf |
char *group_ptr;
|
|
|
ec15cf |
- int old_desc_blocks;
|
|
|
ec15cf |
+ blk64_t old_desc_blocks;
|
|
|
ec15cf |
struct ext2fs_numeric_progress_struct progress;
|
|
|
ec15cf |
|
|
|
ec15cf |
EXT2_CHECK_MAGIC(fs, EXT2_ET_MAGIC_EXT2FS_FILSYS);
|
|
|
ec15cf |
@@ -338,7 +338,7 @@ errcode_t ext2fs_flush2(ext2_filsys fs,
|
|
|
ec15cf |
group_ptr = (char *) group_shadow;
|
|
|
ec15cf |
if (fs->super->s_feature_incompat & EXT2_FEATURE_INCOMPAT_META_BG) {
|
|
|
ec15cf |
old_desc_blocks = fs->super->s_first_meta_bg;
|
|
|
ec15cf |
- if (old_desc_blocks > fs->super->s_first_meta_bg)
|
|
|
ec15cf |
+ if (old_desc_blocks > fs->desc_blocks)
|
|
|
ec15cf |
old_desc_blocks = fs->desc_blocks;
|
|
|
ec15cf |
} else
|
|
|
ec15cf |
old_desc_blocks = fs->desc_blocks;
|