diff mbox series

[3/8] e2fsck: fix ea loop in inc_ea_inode_refs

Message ID 20260924222944.3683556-4-sandeen@redhat.com
State New
Headers show
Series e2fsprogs: fix extended attribute iteration loop bounds checking | expand

Commit Message

Eric Sandeen Sept. 24, 2026, 10:23 p.m. UTC 
From: Andreas Gruenbacher <agruenba@redhat.com>

Fix the same problems as in check_ea_in_inode().

Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Eric Sandeen <sandeen@redhat.com>
---
 e2fsck/pass1.c | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)
diff mbox series

Patch

diff --git a/e2fsck/pass1.c b/e2fsck/pass1.c
index f66a2908..e47e3b04 100644
--- a/e2fsck/pass1.c
+++ b/e2fsck/pass1.c
@@ -412,11 +412,16 @@  static void inc_ea_inode_refs(e2fsck_t ctx, struct problem_context *pctx,
 			      struct ext2_ext_attr_entry *first, void *end)
 {
 	struct ext2_ext_attr_entry *entry = first;
-	struct ext2_ext_attr_entry *np = EXT2_EXT_ATTR_NEXT(entry);
+	unsigned int remain;
 	ea_value_t refs;
 
-	while ((void *) entry < end && (void *) np < end &&
-	       !EXT2_EXT_IS_LAST_ENTRY(entry)) {
+	/* take finish entry 0UL into account */
+	remain = end - (void *)first - sizeof(__u32);
+
+	while (!EXT2_EXT_IS_LAST_ENTRY(entry)) {
+		if (EXT2_EXT_ATTR_LEN(entry->e_name_len) > remain)
+			break;
+		remain -= EXT2_EXT_ATTR_LEN(entry->e_name_len);
 		if (!entry->e_value_inum)
 			goto next;
 		if (!ctx->ea_inode_refs && !alloc_ea_inode_refs(ctx, pctx))
@@ -429,8 +434,7 @@  static void inc_ea_inode_refs(e2fsck_t ctx, struct problem_context *pctx,
 			refs += 1;
 		ea_refcount_store(ctx->ea_inode_refs, entry->e_value_inum, refs);
 	next:
-		entry = np;
-		np = EXT2_EXT_ATTR_NEXT(entry);
+		entry = EXT2_EXT_ATTR_NEXT(entry);
 	}
 }