diff mbox series

[4/8] libext2fs: fix ea loop in ext2fs_ext_attr_block_rehash

Message ID 20260924222944.3683556-5-sandeen@redhat.com
State New
Headers show
Series e2fsprogs: fix extended attribute iteration loop bounds checking | expand

Commit Message

Eric Sandeen Sept. 24, 2026, 10:23 p.m. UTC 
From: Andreas Gruenbacher <agruenba@redhat.com>

Fix the same problems as in check_ea_in_inode().

Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Eric Sandeen <sandeen@redhat.com>
---
 lib/ext2fs/ext_attr.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/lib/ext2fs/ext_attr.c b/lib/ext2fs/ext_attr.c
index 7723d0f9..914bff1d 100644
--- a/lib/ext2fs/ext_attr.c
+++ b/lib/ext2fs/ext_attr.c
@@ -163,10 +163,17 @@  void ext2fs_ext_attr_block_rehash(struct ext2_ext_attr_header *header,
 				  struct ext2_ext_attr_entry *end)
 {
 	struct ext2_ext_attr_entry *here;
+	unsigned int remain;
 	__u32 hash = 0;
 
 	here = (struct ext2_ext_attr_entry *)(header+1);
-	while (here < end && !EXT2_EXT_IS_LAST_ENTRY(here)) {
+	/* take finish entry 0UL into account */
+	remain = (void *)end - (void *)here - sizeof(__u32);
+	while (!EXT2_EXT_IS_LAST_ENTRY(here)) {
+		/* entry->e_name_len is within the first four bytes */
+		if (EXT2_EXT_ATTR_LEN(here->e_name_len) > remain)
+			break;
+		remain -= EXT2_EXT_ATTR_LEN(here->e_name_len);
 		if (!here->e_hash) {
 			/* Block is not shared if an entry's hash value == 0 */
 			hash = 0;