Addresses-Coverity-Bug: 1500765
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
fc_raw_inode = val + sizeof(fc_ino);
ino = le32_to_cpu(fc_ino);
fc_raw_inode = val + sizeof(fc_ino);
ino = le32_to_cpu(fc_ino);
- if (EXT2_INODE_SIZE(ctx->fs->super) > EXT2_GOOD_OLD_INODE_SIZE)
- inode_len += ext2fs_le16_to_cpu(
+ if (EXT2_INODE_SIZE(ctx->fs->super) > EXT2_GOOD_OLD_INODE_SIZE) {
+ __u16 extra_isize = ext2fs_le16_to_cpu(
((struct ext2_inode_large *)fc_raw_inode)->i_extra_isize);
((struct ext2_inode_large *)fc_raw_inode)->i_extra_isize);
+
+ if ((extra_isize < (sizeof(inode->i_extra_isize) +
+ sizeof(inode->i_checksum_hi))) ||
+ (extra_isize > (EXT2_INODE_SIZE(ctx->fs->super) -
+ EXT2_GOOD_OLD_INODE_SIZE))) {
+ err = EFSCORRUPTED;
+ goto out;
+ }
+ inode_len += extra_isize;
+ }
err = ext2fs_get_mem(inode_len, &inode);
if (err)
goto out;
err = ext2fs_get_mem(inode_len, &inode);
if (err)
goto out;