Unverified Commit a8f659ce authored by Konstantin Komarov's avatar Konstantin Komarov
Browse files

fs/ntfs3: Add more checks in mi_enum_attr (part 2) 

Add offset check before access to attr->non_res field as mentioned in [1].

[1] https://lore.kernel.org/ntfs3/20241010110005.42792-1-llfamsec@gmail.com/



Suggested-by: default avatarlei lu <llfamsec@gmail.com>
Signed-off-by: default avatarKonstantin Komarov <almaz.alexandrovich@paragon-software.com>
parent 045fff61

fs/ntfs3/record.c

+13 −3
Original line number Diff line number Diff line
@@ -212,7 +212,7 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr) 
			return NULL;



		if (off >= used || off < MFTRECORD_FIXUP_OFFSET_1 ||

		    !IS_ALIGNED(off, 4)) {

		    !IS_ALIGNED(off, 8)) {

			return NULL;

		}
@@ -236,8 +236,11 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr) 
		off += asize;

	}



	/* Can we use the first field (attr->type). */

	/* NOTE: this code also checks attr->size availability. */

	/*

	 * Can we use the first fields:

	 * attr->type,

	 * attr->size

	 */

	if (off + 8 > used) {

		static_assert(ALIGN(sizeof(enum ATTR_TYPE), 8) == 8);

		return NULL;
@@ -259,10 +262,17 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr) 


	asize = le32_to_cpu(attr->size);



	if (!IS_ALIGNED(asize, 8))

		return NULL;



	/* Check overflow and boundary. */

	if (off + asize < off || off + asize > used)

		return NULL;



	/* Can we use the field attr->non_res. */

	if (off + 9 > used)

		return NULL;



	/* Check size of attribute. */

	if (!attr->non_res) {

		/* Check resident fields. */