From 0415c2624f8be6eac60de2b298de195dd18802d8 Mon Sep 17 00:00:00 2001 From: Jan Kara Date: Fri, 23 Oct 2026 10:41:21 +0200 Subject: [PATCH] udf: Validate extended attribute space is large enough When there is extended attributes space in ICB, there must be at least enough space for the header of this space. Otherwise the fs is corrupted and other offset validity checks could underflow. Reported-by: Lennart Finke Fixes: 127b0d87649f ("udf: Avoid confusion of missing and corrupted extended attributes") Signed-off-by: Jan Kara --- fs/udf/inode.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/fs/udf/inode.c b/fs/udf/inode.c index bacf2a86161e..88b1c7d351e1 100644 --- a/fs/udf/inode.c +++ b/fs/udf/inode.c @@ -1607,6 +1607,11 @@ static int udf_read_inode(struct inode *inode, bool hidden_inode) */ if (iinfo->i_lenEAttr > bs || iinfo->i_lenAlloc > bs) goto out; + /* We need to have space at least for generic descriptor */ + if (iinfo->i_lenEAttr && iinfo->i_lenEAttr < + sizeof(struct extendedAttrHeaderDesc)) + goto out; + /* Now do exact checks */ if (udf_file_entry_alloc_offset(inode) + iinfo->i_lenAlloc > bs) goto out;