bianbu-repo-mirror/bianbu-linux-6.6
1
0
Fork 0
mirror of https://gitee.com/bianbu-linux/linux-6.6 synced 2025-04-24 14:07:52 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

fs/ntfs3: Check if more than chunk-size bytes are written

Browse source 
[ Upstream commit 9931122d04c6d431b2c11b5bb7b10f28584067f0 ]

A incorrectly formatted chunk may decompress into
more than LZNT_CHUNK_SIZE bytes and a index out of bounds
will occur in s_max_off.

Signed-off-by: Andrew Ballance <andrewjballance@gmail.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Andrew Ballance 2024-05-15 07:38:33 -05:00 • committed by Greg Kroah-Hartman
parent 22cdf3be7d
commit 5f21e3e609
1 changed files with 3 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
fs/ntfs3/lznt.c
View file

@ -236,6 +236,9 @@ static inline ssize_t decompress_chunk(u8 *unc, u8 *unc_end, const u8 *cmpr,
/* Do decompression until pointers are inside range. */ /* Do decompression until pointers are inside range. */
while (up < unc_end && cmpr < cmpr_end) { while (up < unc_end && cmpr < cmpr_end) {
// return err if more than LZNT_CHUNK_SIZE bytes are written
if (up - unc > LZNT_CHUNK_SIZE)
return -EINVAL;
/* Correct index */ /* Correct index */
while (unc + s_max_off[index] < up) while (unc + s_max_off[index] < up)
index += 1; index += 1;