Unverified Commit 6bb81b94 authored by Dan Carpenter's avatar Dan Carpenter Committed by Konstantin Komarov
Browse files

fs/ntfs3: Prevent integer overflow in hdr_first_de() 



The "de_off" and "used" variables come from the disk so they both need to
check.  The problem is that on 32bit systems if they're both greater than
UINT_MAX - 16 then the check does work as intended because of an integer
overflow.

Fixes: 60ce8dfd ("fs/ntfs3: Fix wrong if in hdr_first_de")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: default avatarKonstantin Komarov <almaz.alexandrovich@paragon-software.com>
parent 5ad414f4

fs/ntfs3/ntfs.h

+1 −1
Original line number Diff line number Diff line
@@ -717,7 +717,7 @@ static inline struct NTFS_DE *hdr_first_de(const struct INDEX_HDR *hdr) 
	struct NTFS_DE *e;

	u16 esize;



	if (de_off >= used || de_off + sizeof(struct NTFS_DE) > used )

	if (de_off >= used || size_add(de_off, sizeof(struct NTFS_DE)) > used)

		return NULL;



	e = Add2Ptr(hdr, de_off);