| Message ID | 1448569394-27134-1-git-send-email-artemiyv@acm.org |
|---|---|
| State | Superseded, archived |
| Headers | show |
diff --git a/e2fsck/pass1.c b/e2fsck/pass1.c index 0a8e23e..71ea943 100644 --- a/e2fsck/pass1.c +++ b/e2fsck/pass1.c @@ -482,6 +482,10 @@ static void check_inode_extra_space(e2fsck_t ctx, struct problem_context *pctx) return; } + /* check if there is no place for an EA header */ + if (inode->i_extra_size >= max - sizeof(__u32)) + return; + eamagic = (__u32 *) (((char *) inode) + EXT2_GOOD_OLD_INODE_SIZE + inode->i_extra_isize); if (*eamagic == EXT2_EXT_ATTR_MAGIC) {
In check_inode_extra_space(), if we attempt to read an EA header at the end of the extra space, in a corrupted filesystem it may result in a read beyond the bounds of the inode. Add a check to prevent this. Reproduced by running ./test_one --valgrind f_write_ea_toobig_extra_isize. Signed-off-by: Artemiy Volkov <artemiyv@acm.org> --- A quick fix to v1 which wrongly uses spaces instead of tabs. e2fsck/pass1.c | 4 ++++ 1 file changed, 4 insertions(+)