opengnsys
/
ntfs-3g
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Checked that indexes do not exceed the index block size 

Make sure the used part of an index block fits into the allocated buffer.
Note : a negative size may cause overflow on 32-bit cpus.
(contributed by Rakesh Pandit)
edge.strict_endians^2
Jean-Pierre André 2021-07-12 08:31:18 +02:00
parent 20d700841b
commit 5c002438f2
2 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
libntfs-3g/dir.c
View File

@ -425,7 +425,8 @@ descend_into_child_node:
goto close_err_out;
}
index_end = (u8*)&ia->index + le32_to_cpu(ia->index.index_length);
if (index_end > (u8*)ia + index_block_size) {
if (((s32)le32_to_cpu(ia->index.index_length) < 0)
|| (index_end > (u8*)ia + index_block_size)) {
ntfs_log_error("Size of index buffer (VCN 0x%llx) of directory inode "
"0x%llx exceeds maximum size.\n",
(long long)vcn, (unsigned long long)dir_ni->mft_no);

8
libntfs-3g/index.c
View File

@ -421,6 +421,14 @@ static int ntfs_ia_check(ntfs_index_context *icx, INDEX_BLOCK *ib, VCN vcn)
icx->block_size);
return -1;
}
if (((s32)le32_to_cpu(ib->index.index_length) < 0)
|| ((u8*)&ib->index + le32_to_cpu(ib->index.index_length) >
(u8*)ib + icx->block_size)) {
ntfs_log_error("Size of index buffer (%lld) of inode %llu "
"exceeds maximum size.\n", (long long)vcn,
(unsigned long long)icx->ni->mft_no);
return -1;
}
return 0;
}