From dab7435917698bb490cce61fc8be1be0a862cf66 Mon Sep 17 00:00:00 2001 From: "Darrick J. Wong" Date: Sat, 25 Oct 2014 13:56:42 -0700 Subject: [PATCH] libext2fs: directory iteration mustn't walk off the buffer end When we're iterating a directory, the loop control code reads the length of the next directory record, failing to account for the fact that there must be at least 8 bytes (the minimum size of a directory entry) left in the buffer to read the next directory record. Fix the loop conditional so that we don't read off the end of the buffer. Signed-off-by: Darrick J. Wong Reported-by: Sami Liedes Signed-off-by: Theodore Ts'o --- lib/ext2fs/dir_iterate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/ext2fs/dir_iterate.c b/lib/ext2fs/dir_iterate.c index 589af69..0744ee8 100644 --- a/lib/ext2fs/dir_iterate.c +++ b/lib/ext2fs/dir_iterate.c @@ -202,7 +202,7 @@ int ext2fs_process_dir_block(ext2_filsys fs, if (ctx->errcode) return BLOCK_ABORT; - while (offset < fs->blocksize) { + while (offset < fs->blocksize - 8) { dirent = (struct ext2_dir_entry *) (ctx->buf + offset); if (ext2fs_get_rec_len(fs, dirent, &rec_len)) return BLOCK_ABORT; -- 1.8.3.1