diff mbox series

[7/8] resize2fs: fix ea loop in update_xattr_entry_hashes

Message ID 20260924222944.3683556-8-sandeen@redhat.com
State New
Headers show
Series e2fsprogs: fix extended attribute iteration loop bounds checking | expand

Commit Message

Eric Sandeen Sept. 24, 2026, 10:23 p.m. UTC 
From: Andreas Gruenbacher <agruenba@redhat.com>

Fix the same problems as in check_ea_in_inode().

Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Eric Sandeen <sandeen@redhat.com>
---
 resize/resize2fs.c | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/resize/resize2fs.c b/resize/resize2fs.c
index c8964af5..49aa039c 100644
--- a/resize/resize2fs.c
+++ b/resize/resize2fs.c
@@ -2039,13 +2039,28 @@  static void quiet_com_err_proc(const char *whoami EXT2FS_ATTR((unused)),
 {
 }
 
+#define fatal_err(code, args...)		\
+	do {					\
+		com_err(__func__, code, args);	\
+		exit(1);			\
+	} while (0);
+
 static int fix_ea_entries(ext2_extent imap, struct ext2_ext_attr_entry *entry,
 			  struct ext2_ext_attr_entry *end, ext2_ino_t last_ino)
 {
+	unsigned int remain;
 	int modified = 0;
 	ext2_ino_t new_ino;
 
-	while (entry < end && !EXT2_EXT_IS_LAST_ENTRY(entry)) {
+	/* take finish entry 0UL into account */
+	remain = (void *)end - (void *)entry - sizeof(__u32);
+
+	while (!EXT2_EXT_IS_LAST_ENTRY(entry)) {
+		/* end->e_name_len is within the first four bytes */
+		if (EXT2_EXT_ATTR_LEN(entry->e_name_len) > remain)
+			fatal_err(0, "corrupted extended attribute field");
+		remain -= EXT2_EXT_ATTR_LEN(entry->e_name_len);
+
 		if (entry->e_value_inum > last_ino) {
 			new_ino = ext2fs_extent_translate(imap,
 							  entry->e_value_inum);