Commit 10993e52 authored by Hyunchul Lee's avatar Hyunchul Lee Committed by Namjae Jeon
Browse files

ntfs: check $EA query-length in ntfs_ea_get 



if ea_info_qlen exceeds all_ea_size, OOB can happen.

Signed-off-by: default avatarHyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: default avatarNamjae Jeon <linkinjeon@kernel.org>
parent a5325419

fs/ntfs/ea.c

+5 −0
Original line number Diff line number Diff line
@@ -136,6 +136,11 @@ static int ntfs_get_ea(struct inode *inode, const char *name, size_t name_len, 
	if (!ea_buf)

		return -ENODATA;



	if (ea_info_qlen > all_ea_size) {

		err = -EIO;

		goto free_ea_buf;

	}



	err = ntfs_ea_lookup(ea_buf, ea_info_qlen, name, name_len, &ea_off,

			&ea_size);

	if (!err) {