]> git.ipfire.org Git - thirdparty/e2fsprogs.git/commit
projects / thirdparty / e2fsprogs.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: f0770b1) | patch
libext2fs: check ea value offset when loading
authorDarrick J. Wong <darrick.wong@oracle.com>
Thu, 11 Sep 2014 20:17:44 +0000 (13:17 -0700)
committerTheodore Ts'o <tytso@mit.edu>
Thu, 11 Sep 2014 22:10:23 +0000 (18:10 -0400)
commit551ab6d8e0d4c9d3f5745b1e34153e8e9f82621b
tree3a4b14e6a9aa0676ff2ae368e14d0aec9f24a7c7tree | snapshot
parentf0770b16ef4c3052996b8b72ce1587d2332efb89commit | diff
libext2fs: check ea value offset when loading

When reading extended attributes, check e_value_offs to make sure that
it starts in the value area and not the name area.  The attached test
case image will crash the kernel if it is mounted and you append more
than 4096 bytes of data to /a, due to insufficient validation.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
lib/ext2fs/ext_attr.c diff | blob | blame | history
tests/f_ea_value_crash/expect.1 [new file with mode: 0644] blob
tests/f_ea_value_crash/expect.2 [new file with mode: 0644] blob
tests/f_ea_value_crash/image.gz [new file with mode: 0644] blob
tests/f_ea_value_crash/name [new file with mode: 0644] blob
Unnamed repository; edit this file 'description' to name the repository.