]> git.ipfire.org Git - thirdparty/e2fsprogs.git/commit
fuse2fs: fix memory corruption when parsing mount options
authorDarrick J. Wong <djwong@kernel.org>
Fri, 5 Sep 2025 21:56:02 +0000 (14:56 -0700)
committerDarrick J. Wong <djwong@kernel.org>
Fri, 17 Oct 2025 23:34:21 +0000 (16:34 -0700)
commitfdfc5b030a01c43a0e1d02d26be20b3db45979d1
tree46509071868513264fa83e2386bb73cd9bb4d340
parentc8088d9e492f0a72bcd591d78bc99a8721f9fe5b
fuse2fs: fix memory corruption when parsing mount options

struct fuse_opt has this interesting behavior -- if you set the offset
field to a non-negative value, then it will treat that value as a byte
offset into the data parameter that is passed to fuse_opt_parse.

Unfortnately, process_opt computes a pointer from ((char *)data +
offset), casts that to an int pointer(!), and dereferences the int
pointer to set the value.  Therefore, we cannot have uint8_t fields in
struct fuse2fs because that will lead to subtle memory corruption.

Cc: <linux-ext4@vger.kernel.org> # v1.47.3
Fixes: c7f2688540d95e ("fuse2fs: compact all the boolean flags in struct fuse2fs")
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
misc/fuse2fs.c