|
 |
e427d2 |
From b7466a55e89aa6d6a649734f2b1b24a03390bcef Mon Sep 17 00:00:00 2001
|
|
|
e427d2 |
From: Theodore Ts'o <tytso@mit.edu>
|
|
|
e427d2 |
Date: Wed, 26 Aug 2020 16:29:29 -0400
|
|
|
e427d2 |
Subject: [PATCH 08/46] libext2fs: fix potential buffer overrun in
|
|
|
e427d2 |
__get_dirent_tail()
|
|
|
e427d2 |
Content-Type: text/plain
|
|
|
e427d2 |
|
|
|
e427d2 |
If the file system is corrupted, there is a potential of a read-only
|
|
|
e427d2 |
buffer overrun. Fortunately, we don't actually use the result of that
|
|
|
e427d2 |
pointer dereference, and the overrun is at most 64k.
|
|
|
e427d2 |
|
|
|
e427d2 |
Google-Bug-Id: #158564737
|
|
|
e427d2 |
Fixes: eb88b751745b ("libext2fs: make ext2fs_dirent_has_tail() more strict")
|
|
|
e427d2 |
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
|
|
|
e427d2 |
Signed-off-by: Lukas Czerner <lczerner@redhat.com>
|
|
|
e427d2 |
---
|
|
|
e427d2 |
lib/ext2fs/csum.c | 3 +--
|
|
|
e427d2 |
1 file changed, 1 insertion(+), 2 deletions(-)
|
|
|
e427d2 |
|
|
|
e427d2 |
diff --git a/lib/ext2fs/csum.c b/lib/ext2fs/csum.c
|
|
|
e427d2 |
index a7172580..2151003b 100644
|
|
|
e427d2 |
--- a/lib/ext2fs/csum.c
|
|
|
e427d2 |
+++ b/lib/ext2fs/csum.c
|
|
|
e427d2 |
@@ -266,12 +266,11 @@ static errcode_t __get_dirent_tail(ext2_filsys fs,
|
|
|
e427d2 |
d = dirent;
|
|
|
e427d2 |
top = EXT2_DIRENT_TAIL(dirent, fs->blocksize);
|
|
|
e427d2 |
|
|
|
e427d2 |
- rec_len = translate(d->rec_len);
|
|
|
e427d2 |
while ((void *) d < top) {
|
|
|
e427d2 |
+ rec_len = translate(d->rec_len);
|
|
|
e427d2 |
if ((rec_len < 8) || (rec_len & 0x03))
|
|
|
e427d2 |
return EXT2_ET_DIR_CORRUPTED;
|
|
|
e427d2 |
d = (struct ext2_dir_entry *)(((char *)d) + rec_len);
|
|
|
e427d2 |
- rec_len = translate(d->rec_len);
|
|
|
e427d2 |
}
|
|
|
e427d2 |
|
|
|
e427d2 |
if ((void *)d > ((void *)dirent + fs->blocksize))
|
|
|
e427d2 |
--
|
|
|
e427d2 |
2.35.1
|
|
|
e427d2 |
|