diff mbox series

[8/8] libext2fs: fix ea loop in ext2fs_xattr_inode_max_size

Message ID 20260924222944.3683556-9-sandeen@redhat.com
State New
Headers show
Series e2fsprogs: fix extended attribute iteration loop bounds checking | expand

Commit Message

Eric Sandeen Sept. 24, 2026, 10:23 p.m. UTC 
From: Andreas Gruenbacher <agruenba@redhat.com>

Fix the same problems as in check_ea_in_inode().

Found by AISLE in partnership with Red Hat.

Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Eric Sandeen <sandeen@redhat.com>
---
 lib/ext2fs/ext_attr.c | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)
diff mbox series

Patch

diff --git a/lib/ext2fs/ext_attr.c b/lib/ext2fs/ext_attr.c
index 6f6d2f4f..f2ac8911 100644
--- a/lib/ext2fs/ext_attr.c
+++ b/lib/ext2fs/ext_attr.c
@@ -1211,8 +1211,8 @@  errcode_t ext2fs_xattr_inode_max_size(ext2_filsys fs, ext2_ino_t ino,
 	struct ext2_ext_attr_entry *entry;
 	struct ext2_inode_large *inode;
 	__u32 ea_inode_magic;
-	unsigned int minoff;
-	char *start;
+	unsigned int minoff, remain;
+	char *start, *end;
 	size_t i;
 	errcode_t err;
 
@@ -1241,14 +1241,25 @@  errcode_t ext2fs_xattr_inode_max_size(ext2_filsys fs, ext2_ino_t ino,
 	       inode->i_extra_isize, sizeof(__u32));
 	if (ea_inode_magic == EXT2_EXT_ATTR_MAGIC) {
 		/* has xattrs.  calculate the size */
-		start= ((char *) inode) + EXT2_GOOD_OLD_INODE_SIZE +
+		start = ((char *) inode) + EXT2_GOOD_OLD_INODE_SIZE +
 			inode->i_extra_isize + sizeof(__u32);
+		end = (char *)inode + EXT2_INODE_SIZE(fs->super);
+		/* take finish entry 0UL into account */
+		remain = end - (char *)start - sizeof(__u32);
 		entry = (struct ext2_ext_attr_entry *) start;
 		while (!EXT2_EXT_IS_LAST_ENTRY(entry)) {
+			/* end->e_name_len is within the first four bytes */
+			if (EXT2_EXT_ATTR_LEN(entry->e_name_len) > remain)
+				return EXT2_ET_INLINE_DATA_NO_SPACE;
+			remain -= EXT2_EXT_ATTR_LEN(entry->e_name_len);
+
 			if (!entry->e_value_inum && entry->e_value_size) {
 				unsigned int offs = entry->e_value_offs;
 				if (offs < minoff)
 					minoff = offs;
+				if (EXT2_EXT_ATTR_SIZE(entry->e_value_size) > remain)
+					return EXT2_ET_INLINE_DATA_NO_SPACE;
+				remain -= EXT2_EXT_ATTR_SIZE(entry->e_value_size);
 			}
 			entry = EXT2_EXT_ATTR_NEXT(entry);
 		}