diff mbox series

[6/8] tune2fs: fix ea loop in update_xattr_entry_hashes

Message ID 20260924222944.3683556-7-sandeen@redhat.com
State New
Headers show
Series e2fsprogs: fix extended attribute iteration loop bounds checking | expand

Commit Message

Eric Sandeen Sept. 24, 2026, 10:23 p.m. UTC 
From: Andreas Gruenbacher <agruenba@redhat.com>

Fix the same problems as in check_ea_in_inode().

Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Eric Sandeen <sandeen@redhat.com>
---
 misc/tune2fs.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)
diff mbox series

Patch

diff --git a/misc/tune2fs.c b/misc/tune2fs.c
index 2d85fb70..53a7a1b2 100644
--- a/misc/tune2fs.c
+++ b/misc/tune2fs.c
@@ -774,13 +774,19 @@  static int update_xattr_entry_hashes(ext2_filsys fs,
 				     struct ext2_ext_attr_entry *entry,
 				     struct ext2_ext_attr_entry *end)
 {
+	unsigned int remain;
 	int modified = 0;
 	errcode_t retval;
 
-	while (entry < end && !EXT2_EXT_IS_LAST_ENTRY(entry)) {
-		if ((char *) entry + sizeof(struct ext2_ext_attr_entry) >=
-		    (char *) end)
+	/* take finish entry 0UL into account */
+	remain = (void *)end - (void *)entry - sizeof(__u32);
+
+	while (!EXT2_EXT_IS_LAST_ENTRY(entry)) {
+		/* end->e_name_len is within the first four bytes */
+		if (EXT2_EXT_ATTR_LEN(entry->e_name_len) > remain)
 			fatal_err(0, "corrupted extended attribute field");
+		remain -= EXT2_EXT_ATTR_LEN(entry->e_name_len);
+
 		if (entry->e_value_inum) {
 			retval = ext2fs_ext_attr_hash_entry2(fs, entry, NULL,
 							     &entry->e_hash);