github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-06 21:58:01 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

udf: Validate extended attribute space is large enough

Browse Source 
When there is extended attributes space in ICB, there must be at least
enough space for the header of this space. Otherwise the fs is corrupted
and other offset validity checks could underflow.

Reported-by: Lennart Finke <lfinke@student.ethz.ch>
Fixes: 127b0d8764 ("udf: Avoid confusion of missing and corrupted extended attributes")
Signed-off-by: Jan Kara <jack@suse.cz>
This commit is contained in:
Jan Kara 2026-10-23 10:41:21 +02:00
parent e21a6f39aa
commit 0415c2624f
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
fs/udf/inode.c
View File

@ -1607,6 +1607,11 @@ static int udf_read_inode(struct inode *inode, bool hidden_inode)
*/
if (iinfo->i_lenEAttr > bs || iinfo->i_lenAlloc > bs)
goto out;
/* We need to have space at least for generic descriptor */
if (iinfo->i_lenEAttr && iinfo->i_lenEAttr <
sizeof(struct extendedAttrHeaderDesc))
goto out;
/* Now do exact checks */
if (udf_file_entry_alloc_offset(inode) + iinfo->i_lenAlloc > bs)
goto out;