ntfs: check $EA query-length in ntfs_ea_get

if ea_info_qlen exceeds all_ea_size, OOB can happen.

Signed-off-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>

diff --git a/fs/ntfs/ea.c b/fs/ntfs/ea.c
index d479bf3608c8576fcb1258f40b9ef7a69d4d005d..115e3c5552a33bfa8936e07a9ab26e26ae1d5f6b 100644 (file)
--- a/fs/ntfs/ea.c
+++ b/fs/ntfs/ea.c
@@ -136,6 +136,11 @@ static int ntfs_get_ea(struct inode *inode, const char *name, size_t name_len,
        if (!ea_buf)
                return -ENODATA;
 
+       if (ea_info_qlen > all_ea_size) {
+               err = -EIO;
+               goto free_ea_buf;
+       }
+
        err = ntfs_ea_lookup(ea_buf, ea_info_qlen, name, name_len, &ea_off,
                        &ea_size);
        if (!err) {