From: Dan Carpenter Date: Sun, 16 Feb 2025 20:52:10 +0000 (+0300) Subject: fs/ntfs3: Prevent integer overflow in hdr_first_de() X-Git-Tag: v6.15-rc1~52^2~3 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6bb81b94f7a9cba6bde9a905cef52a65317a8b04;p=thirdparty%2Flinux.git fs/ntfs3: Prevent integer overflow in hdr_first_de() The "de_off" and "used" variables come from the disk so they both need to check. The problem is that on 32bit systems if they're both greater than UINT_MAX - 16 then the check does work as intended because of an integer overflow. Fixes: 60ce8dfde035 ("fs/ntfs3: Fix wrong if in hdr_first_de") Signed-off-by: Dan Carpenter Signed-off-by: Konstantin Komarov --- diff --git a/fs/ntfs3/ntfs.h b/fs/ntfs3/ntfs.h index 241f2ffdd9201..1ff13b6f96132 100644 --- a/fs/ntfs3/ntfs.h +++ b/fs/ntfs3/ntfs.h @@ -717,7 +717,7 @@ static inline struct NTFS_DE *hdr_first_de(const struct INDEX_HDR *hdr) struct NTFS_DE *e; u16 esize; - if (de_off >= used || de_off + sizeof(struct NTFS_DE) > used ) + if (de_off >= used || size_add(de_off, sizeof(struct NTFS_DE)) > used) return NULL; e = Add2Ptr(hdr, de_off);