Whamcloud - gitweb
libext2fs: fix potential memory access overrun in ext2fs_inode_csum()
If the superblock has a revision level of 0, then s_inode_size is
undefined, and the actual inode size is 128 bytes. This is handled by
the EXT2_INODE_SIZE() helper macro. If s_inode_size is maliciously
set to a large value, and the s_rev_level is 0, then this could result
in an illegal memory pointer dereference.
Addresses-Debian-Bug: #878104
Reported-by: Jakub Wilk <jwilk@jwilk.net>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>