diff mbox series

[3/4] blkid: probe_ntfs: validate offset and length of volume name

Message ID 20260924210421.3631790-4-sandeen@redhat.com
State New
Headers show
Series e2fsprogs: blkid: misc fixes | expand

Commit Message

Eric Sandeen Sept. 24, 2026, 9:02 p.m. UTC 
From: Eric Sandeen <esandeen@redhat.com>

Ensure that the volume name fits within the attribute offset

Signed-off-by: Eric Sandeen <sandeen@redhat.com>
---
 lib/blkid/probe.c | 7 +++++++
 1 file changed, 7 insertions(+)
diff mbox series

Patch

diff --git a/lib/blkid/probe.c b/lib/blkid/probe.c
index ae769a77..87167171 100644
--- a/lib/blkid/probe.c
+++ b/lib/blkid/probe.c
@@ -773,6 +773,13 @@  static int probe_ntfs(struct blkid_probe *probe,
 			break;
 
 		if (attr_type == MFT_RECORD_ATTR_VOLUME_NAME) {
+			/* Value length must be multiple of two (UTF-16LE) */
+			if (val_len & 1)
+				break;
+			/* End of value must be within attr length */
+			if (val_off > attr_len || val_len > attr_len - val_off)
+				break;
+
 			if (val_len > sizeof(label_str))
 				val_len = sizeof(label_str)-1;