Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-11-21 19:41:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

fs/ntfs3: Sequential field availability check in mi_enum_attr()

Browse Source 
The code is slightly reformatted to consistently check field availability
without duplication.

Fixes: 556bdf27c2 ("ntfs3: Add bounds checking to mi_enum_attr()")
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
This commit is contained in:
Konstantin Komarov 2024-09-05 15:03:48 +03:00
parent d178944db3
commit 090f612756
No known key found for this signature in database
GPG Key ID: A9B0331F832407B6
1 changed files with 7 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
fs/ntfs3/record.c
View File

@ -237,6 +237,7 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr)
} }
/* Can we use the first field (attr->type). */ /* Can we use the first field (attr->type). */
/* NOTE: this code also checks attr->size availability. */
if (off + 8 > used) { if (off + 8 > used) {
static_assert(ALIGN(sizeof(enum ATTR_TYPE), 8) == 8); static_assert(ALIGN(sizeof(enum ATTR_TYPE), 8) == 8);
return NULL; return NULL;
@ -257,10 +258,6 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr)
return NULL; return NULL;
asize = le32_to_cpu(attr->size); asize = le32_to_cpu(attr->size);
if (asize < SIZEOF_RESIDENT) {
/* Impossible 'cause we should not return such attribute. */
return NULL;
}
/* Check overflow and boundary. */ /* Check overflow and boundary. */
if (off + asize < off || off + asize > used) if (off + asize < off || off + asize > used)
@ -290,6 +287,10 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr)
if (attr->non_res != 1) if (attr->non_res != 1)
return NULL; return NULL;
/* Can we use memory including attr->nres.valid_size? */
if (asize < SIZEOF_NONRESIDENT)
return NULL;
t16 = le16_to_cpu(attr->nres.run_off); t16 = le16_to_cpu(attr->nres.run_off);
if (t16 > asize) if (t16 > asize)
return NULL; return NULL;
@ -316,7 +317,8 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr)
if (!attr->nres.svcn && is_attr_ext(attr)) { if (!attr->nres.svcn && is_attr_ext(attr)) {
/* First segment of sparse/compressed attribute */ /* First segment of sparse/compressed attribute */
if (asize + 8 < SIZEOF_NONRESIDENT_EX) /* Can we use memory including attr->nres.total_size? */
if (asize < SIZEOF_NONRESIDENT_EX)
return NULL; return NULL;
tot_size = le64_to_cpu(attr->nres.total_size); tot_size = le64_to_cpu(attr->nres.total_size);
@ -326,9 +328,6 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr)
if (tot_size > alloc_size) if (tot_size > alloc_size)
return NULL; return NULL;
} else { } else {
if (asize + 8 < SIZEOF_NONRESIDENT)
return NULL;
if (attr->nres.c_unit) if (attr->nres.c_unit)
return NULL; return NULL;