From a0d24f90027dc0db2733f2901426b7c24fbaf05a Mon Sep 17 00:00:00 2001 From: Andreas Dilger Date: Thu, 12 Apr 2012 15:23:47 -0600 Subject: [PATCH] e2fsck: improve in-inode xattr checks Add check for in-inode xattr to make sure that it is not referencing an offset that is beyond the end of the inode. Signed-off-by: Andreas Dilger --- .gitignore | 1 + e2fsck/pass1.c | 7 +++++++ e2fsck/problem.c | 4 ++++ e2fsck/problem.h | 4 ++++ 4 files changed, 16 insertions(+) diff --git a/.gitignore b/.gitignore index 7262ac4..9767ebd 100644 --- a/.gitignore +++ b/.gitignore @@ -113,6 +113,7 @@ lib/ext2fs/tst_inline lib/ext2fs/tst_inode_size lib/ext2fs/tst_iscan lib/ext2fs/tst_libext2fs +lib/ext2fs/tst_read_ea lib/ext2fs/tst_super_size lib/ext2fs/tst_types lib/libblkid.a diff --git a/e2fsck/pass1.c b/e2fsck/pass1.c index 9ef724a..ceb4a7b 100644 --- a/e2fsck/pass1.c +++ b/e2fsck/pass1.c @@ -320,6 +320,13 @@ static void check_ea_in_inode(e2fsck_t ctx, struct problem_context *pctx) goto fix; } + /* Value size cannot be larger than EA space in inode */ + if (entry->e_value_offs > storage_size || + entry->e_value_offs + entry->e_value_size > storage_size) { + problem = PR_1_INODE_EA_BAD_VALUE; + goto fix; + } + hash = ext2fs_ext_attr_hash_entry(entry, start + entry->e_value_offs); diff --git a/e2fsck/problem.c b/e2fsck/problem.c index 4c105bb..184d36d 100644 --- a/e2fsck/problem.c +++ b/e2fsck/problem.c @@ -966,6 +966,10 @@ static struct e2fsck_problem problem_table[] = { N_("@i %i, end of extent exceeds allowed value\n\t(logical @b %c, physical @b %b, len %N)\n"), PROMPT_CLEAR, 0 }, + /* Bad extended attribute value in inode */ + { PR_1_INODE_EA_BAD_VALUE, + N_("@a in @i %i is corrupt (@n value)."), + PROMPT_CLEAR, 0}, /* Pass 1b errors */ diff --git a/e2fsck/problem.h b/e2fsck/problem.h index 6cb09cf..81cb69b 100644 --- a/e2fsck/problem.h +++ b/e2fsck/problem.h @@ -565,6 +565,10 @@ struct problem_context { #define PR_1_EXTENT_INDEX_START_INVALID 0x01006D #define PR_1_EXTENT_END_OUT_OF_BOUNDS 0x01006E + +/* Bad extended attribute value in inode */ +#define PR_1_INODE_EA_BAD_VALUE 0x010070 + /* * Pass 1b errors */ -- 1.8.3.1