Skip to content

Commit 30200ef

Browse files
fs/ntfs3: Restore overflow checking for attr size in mi_enum_attr
Fixed comment. Removed explicit initialization for INDEX_ROOT. Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
1 parent 318d016 commit 30200ef

3 files changed

Lines changed: 10 additions & 4 deletions

File tree

fs/ntfs3/index.c

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -994,7 +994,7 @@ struct INDEX_ROOT *indx_get_root(struct ntfs_index *indx, struct ntfs_inode *ni,
994994
struct ATTR_LIST_ENTRY *le = NULL;
995995
struct ATTRIB *a;
996996
const struct INDEX_NAMES *in = &s_index_names[indx->type];
997-
struct INDEX_ROOT *root = NULL;
997+
struct INDEX_ROOT *root;
998998

999999
a = ni_find_attr(ni, NULL, &le, ATTR_ROOT, in->name, in->name_len, NULL,
10001000
mi);
@@ -1007,8 +1007,9 @@ struct INDEX_ROOT *indx_get_root(struct ntfs_index *indx, struct ntfs_inode *ni,
10071007
root = resident_data_ex(a, sizeof(struct INDEX_ROOT));
10081008

10091009
/* length check */
1010-
if (root && offsetof(struct INDEX_ROOT, ihdr) + le32_to_cpu(root->ihdr.used) >
1011-
le32_to_cpu(a->res.data_size)) {
1010+
if (root &&
1011+
offsetof(struct INDEX_ROOT, ihdr) + le32_to_cpu(root->ihdr.used) >
1012+
le32_to_cpu(a->res.data_size)) {
10121013
return NULL;
10131014
}
10141015

fs/ntfs3/record.c

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -220,6 +220,11 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr)
220220
return NULL;
221221
}
222222

223+
if (off + asize < off) {
224+
/* Overflow check. */
225+
return NULL;
226+
}
227+
223228
attr = Add2Ptr(attr, asize);
224229
off += asize;
225230
}

fs/ntfs3/super.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1187,7 +1187,7 @@ static int ntfs_fill_super(struct super_block *sb, struct fs_context *fc)
11871187

11881188
/*
11891189
* Typical $AttrDef contains up to 20 entries.
1190-
* Check for extremely large size.
1190+
* Check for extremely large/small size.
11911191
*/
11921192
if (inode->i_size < sizeof(struct ATTR_DEF_ENTRY) ||
11931193
inode->i_size > 100 * sizeof(struct ATTR_DEF_ENTRY)) {

0 commit comments

Comments
 (0)