github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-04 12:35:52 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

ntfs: limit memory allocation in ntfs_attr_readall

Browse Source 
check an attribute size before memory allocation, and reject if the size
is over the maximum size.

Signed-off-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
This commit is contained in:
Hyunchul Lee 2026-04-03 10:10:39 +09:00 committed by Namjae Jeon
parent ca513e492f
commit 0b79de3299
1 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
fs/ntfs/attrib.c
View File

@ -29,6 +29,13 @@
__le16 AT_UNNAMED[] = { cpu_to_le16('\0') };
/*
* Maximum size allowed for reading attributes by ntfs_attr_readall().
* Extended attribute, reparse point are not expected to be larger than this size.
*/
#define NTFS_ATTR_READALL_MAX_SIZE (64 * 1024)
/*
* ntfs_map_runlist_nolock - map (a part of) a runlist of an ntfs inode
* @ni: ntfs inode for which to map (part of) a runlist
@ -5117,6 +5124,13 @@ void *ntfs_attr_readall(struct ntfs_inode *ni, const __le32 type,
}
bmp_ni = NTFS_I(bmp_vi);
if (bmp_ni->data_size > NTFS_ATTR_READALL_MAX_SIZE &&
(bmp_ni->type != AT_BITMAP ||
bmp_ni->data_size > ((ni->vol->nr_clusters + 7) >> 3))) {
ntfs_error(sb, "Invalid attribute data size");
goto out;
}
data = kvmalloc(bmp_ni->data_size, GFP_NOFS);
if (!data)
goto out;