e2fsck: improve in-inode xattr checks

Add check for in-inode xattr to make sure that it is not referencing
an offset that is beyond the end of the inode.

Signed-off-by: Andreas Dilger <andreas.dilger@intel.com>

diff --git a/.gitignore b/.gitignore
index 328df77..45f0cba 100644 (file)
--- a/.gitignore
+++ b/.gitignore
@@ -100,6 +100,7 @@ lib/ext2fs/tst_icount
 lib/ext2fs/tst_inline
 lib/ext2fs/tst_inode_size
 lib/ext2fs/tst_iscan
+lib/ext2fs/tst_read_ea
 lib/ext2fs/tst_super_size
 lib/ext2fs/tst_types
 lib/libblkid.a

diff --git a/e2fsck/pass1.c b/e2fsck/pass1.c
index 9c37515..472de1d 100644 (file)
--- a/e2fsck/pass1.c
+++ b/e2fsck/pass1.c
@@ -320,6 +320,13 @@ static void check_ea_in_inode(e2fsck_t ctx, struct problem_context *pctx)
                        goto fix;
                }
 
+               /* Value size cannot be larger than EA space in inode */
+               if (entry->e_value_offs > storage_size ||
+                   entry->e_value_offs + entry->e_value_size > storage_size) {
+                       problem = PR_1_INODE_EA_BAD_VALUE;
+                       goto fix;
+               }
+
                hash = ext2fs_ext_attr_hash_entry(entry,
                                                  start + entry->e_value_offs);
 

diff --git a/e2fsck/problem.c b/e2fsck/problem.c
index 05ef626..4787883 100644 (file)
--- a/e2fsck/problem.c
+++ b/e2fsck/problem.c
@@ -954,6 +954,12 @@ static struct e2fsck_problem problem_table[] = {
             "Logical start %b does not match logical start %c at next level.  "),
          PROMPT_FIX, 0 },
 
+
+       /* Bad extended attribute value in inode */
+       { PR_1_INODE_EA_BAD_VALUE,
+         N_("@a in @i %i is corrupt (@n value)."),
+         PROMPT_CLEAR, 0},
+
        /* Pass 1b errors */
 
        /* Pass 1B: Rescan for duplicate/bad blocks */

diff --git a/e2fsck/problem.h b/e2fsck/problem.h
index aed524d..4f66922 100644 (file)
--- a/e2fsck/problem.h
+++ b/e2fsck/problem.h
@@ -561,6 +561,10 @@ struct problem_context {
 /* Index start doesn't match start of next extent down */
 #define PR_1_EXTENT_INDEX_START_INVALID        0x01006D
 
+
+/* Bad extended attribute value in inode */
+#define PR_1_INODE_EA_BAD_VALUE                0x010070
+
 /*
  * Pass 1b errors
  */