Skip to content

Commit fc49924

Browse files
fs/ntfs3: Add null pointer checks
Added null pointer checks in function ntfs_security_init. Also added le32_to_cpu in functions ntfs_security_init and indx_read. Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
1 parent e479f0a commit fc49924

2 files changed

Lines changed: 12 additions & 7 deletions

File tree

fs/ntfs3/fsntfs.c

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1876,10 +1876,12 @@ int ntfs_security_init(struct ntfs_sb_info *sbi)
18761876
goto out;
18771877
}
18781878

1879-
root_sdh = resident_data_ex(attr, sizeof(struct INDEX_ROOT));
1880-
if (root_sdh->type != ATTR_ZERO ||
1879+
if(!(root_sdh = resident_data_ex(attr, sizeof(struct INDEX_ROOT))) ||
1880+
root_sdh->type != ATTR_ZERO ||
18811881
root_sdh->rule != NTFS_COLLATION_TYPE_SECURITY_HASH ||
1882-
offsetof(struct INDEX_ROOT, ihdr) + root_sdh->ihdr.used > attr->res.data_size) {
1882+
offsetof(struct INDEX_ROOT, ihdr) +
1883+
le32_to_cpu(root_sdh->ihdr.used) >
1884+
le32_to_cpu(attr->res.data_size)) {
18831885
err = -EINVAL;
18841886
goto out;
18851887
}
@@ -1895,10 +1897,12 @@ int ntfs_security_init(struct ntfs_sb_info *sbi)
18951897
goto out;
18961898
}
18971899

1898-
root_sii = resident_data_ex(attr, sizeof(struct INDEX_ROOT));
1899-
if (root_sii->type != ATTR_ZERO ||
1900+
if(!(root_sii = resident_data_ex(attr, sizeof(struct INDEX_ROOT))) ||
1901+
root_sii->type != ATTR_ZERO ||
19001902
root_sii->rule != NTFS_COLLATION_TYPE_UINT ||
1901-
offsetof(struct INDEX_ROOT, ihdr) + root_sii->ihdr.used > attr->res.data_size) {
1903+
offsetof(struct INDEX_ROOT, ihdr) +
1904+
le32_to_cpu(root_sii->ihdr.used) >
1905+
le32_to_cpu(attr->res.data_size)) {
19021906
err = -EINVAL;
19031907
goto out;
19041908
}

fs/ntfs3/index.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1102,7 +1102,8 @@ int indx_read(struct ntfs_index *indx, struct ntfs_inode *ni, CLST vbn,
11021102
}
11031103

11041104
/* check for index header length */
1105-
if (offsetof(struct INDEX_BUFFER, ihdr) + ib->ihdr.used > bytes) {
1105+
if (offsetof(struct INDEX_BUFFER, ihdr) + le32_to_cpu(ib->ihdr.used) >
1106+
bytes) {
11061107
err = -EINVAL;
11071108
goto out;
11081109
}

0 commit comments

Comments
 (0)