opengnsys
/
ntfs-3g
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fixed the computation of the end of index entry 

The end of an index entry is related to its full length, not to the
length of the key. Added an error message in an overflow case.
edge.strict_endians^2
Jean-Pierre André 2021-07-12 08:31:18 +02:00
parent 5c002438f2
commit 67f959df96
1 changed files with 12 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
libntfs-3g/dir.c
View File

@ -306,10 +306,11 @@ u64 ntfs_inode_lookup_by_name(ntfs_inode *dir_ni,
/* Bounds checks. */
if ((u8*)ie < (u8*)ctx->mrec || (u8*)ie +
sizeof(INDEX_ENTRY_HEADER) > index_end ||
(u8*)ie + le16_to_cpu(ie->key_length) >
(u8*)ie + le16_to_cpu(ie->length) >
index_end) {
ntfs_log_error("Index entry out of bounds in inode %lld"
"\n", (unsigned long long)dir_ni->mft_no);
ntfs_log_error("Index root entry out of bounds in"
" inode %lld\n",
(unsigned long long)dir_ni->mft_no);
goto put_err_out;
}
/*
@ -446,7 +447,7 @@ descend_into_child_node:
/* Bounds check. */
if ((u8*)ie < (u8*)ia || (u8*)ie +
sizeof(INDEX_ENTRY_HEADER) > index_end ||
(u8*)ie + le16_to_cpu(ie->key_length) >
(u8*)ie + le16_to_cpu(ie->length) >
index_end) {
ntfs_log_error("Index entry out of bounds in directory "
"inode %lld.\n",
@ -1248,9 +1249,13 @@ int ntfs_readdir(ntfs_inode *dir_ni, s64 *pos,
/* Bounds checks. */
if ((u8*)ie < (u8*)ctx->mrec || (u8*)ie +
sizeof(INDEX_ENTRY_HEADER) > index_end ||
(u8*)ie + le16_to_cpu(ie->key_length) >
index_end)
(u8*)ie + le16_to_cpu(ie->length) >
index_end) {
ntfs_log_error("Index root entry out of bounds in"
" inode %lld\n",
(unsigned long long)dir_ni->mft_no);
goto dir_err_out;
}
/* The last entry cannot contain a name. */
if (ie->ie_flags & INDEX_ENTRY_END)
break;
@ -1408,7 +1413,7 @@ find_next_index_buffer:
/* Bounds checks. */
if ((u8*)ie < (u8*)ia || (u8*)ie +
sizeof(INDEX_ENTRY_HEADER) > index_end ||
(u8*)ie + le16_to_cpu(ie->key_length) >
(u8*)ie + le16_to_cpu(ie->length) >
index_end) {
ntfs_log_error("Index entry out of bounds in directory inode "
"%lld.\n", (unsigned long long)dir_ni->mft_no);