50 lines
1.5 KiB
Diff
50 lines
1.5 KiB
Diff
|
From 6f4fd2e38aa87535f1a03a5fb4fc172a260acf25 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Richard Weinberger <richard@nod.at>
|
||
|
|
Date: Fri, 9 Aug 2024 11:54:28 +0200
|
||
|
|
Subject: [PATCH] ext4: Fix integer overflow in ext4fs_read_symlink()
|
||
|
|
|
||
|
|
While zalloc() takes a size_t type, adding 1 to the le32 variable
|
||
|
|
will overflow.
|
||
|
|
A carefully crafted ext4 filesystem can exhibit an inode size of 0xffffffff
|
||
|
|
and as consequence zalloc() will do a zero allocation.
|
||
|
|
|
||
|
|
Later in the function the inode size is again used for copying data.
|
||
|
|
So an attacker can overwrite memory.
|
||
|
|
|
||
|
|
Avoid the overflow by using the __builtin_add_overflow() helper.
|
||
|
|
|
||
|
|
Signed-off-by: Richard Weinberger <richard@nod.at>
|
||
|
|
(cherry picked from 35f75d2a46e5859138c83a75cd2f4141c5479ab9)
|
||
|
|
Signed-off-by: Andrea della Porta <andrea.porta@suse.com>
|
||
|
|
---
|
||
|
|
fs/ext4/ext4_common.c | 7 ++++++-
|
||
|
|
1 file changed, 6 insertions(+), 1 deletion(-)
|
||
|
|
|
||
|
|
diff --git a/fs/ext4/ext4_common.c b/fs/ext4/ext4_common.c
|
||
|
|
index 9a9c520e..903c87db 100644
|
||
|
|
--- a/fs/ext4/ext4_common.c
|
||
|
|
+++ b/fs/ext4/ext4_common.c
|
||
|
|
@@ -2188,13 +2188,18 @@ static char *ext4fs_read_symlink(struct ext2fs_node *node)
|
||
|
|
struct ext2fs_node *diro = node;
|
||
|
|
int status;
|
||
|
|
loff_t actread;
|
||
|
|
+ size_t alloc_size;
|
||
|
|
|
||
|
|
if (!diro->inode_read) {
|
||
|
|
status = ext4fs_read_inode(diro->data, diro->ino, &diro->inode);
|
||
|
|
if (status == 0)
|
||
|
|
return NULL;
|
||
|
|
}
|
||
|
|
- symlink = zalloc(le32_to_cpu(diro->inode.size) + 1);
|
||
|
|
+
|
||
|
|
+ if (__builtin_add_overflow(le32_to_cpu(diro->inode.size), 1, &alloc_size))
|
||
|
|
+ return NULL;
|
||
|
|
+
|
||
|
|
+ symlink = zalloc(alloc_size);
|
||
|
|
if (!symlink)
|
||
|
|
return NULL;
|
||
|
|
|
||
|
|
--
|
||
|
|
2.35.3
|
||
|
|
|