Whamcloud - gitweb
libext2fs: fix potential memory access overrun in ext2fs_inode_csum()
authorTheodore Ts'o <tytso@mit.edu>
Mon, 16 Oct 2017 04:28:45 +0000 (00:28 -0400)
committerTheodore Ts'o <tytso@mit.edu>
Mon, 16 Oct 2017 04:28:45 +0000 (00:28 -0400)
commitd1ccc6e58bf80d07c131f074f1222a67c82bc6af
tree71a27291b0848bcef8b48031d4aeeaf9bd8c06bd
parent852dae6f602084e30e305143e61da35ac224338f
libext2fs: fix potential memory access overrun in ext2fs_inode_csum()

If the superblock has a revision level of 0, then s_inode_size is
undefined, and the actual inode size is 128 bytes.  This is handled by
the EXT2_INODE_SIZE() helper macro.  If s_inode_size is maliciously
set to a large value, and the s_rev_level is 0, then this could result
in an illegal memory pointer dereference.

Addresses-Debian-Bug: #878104
Reported-by: Jakub Wilk <jwilk@jwilk.net>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
lib/ext2fs/csum.c