From: Andreas Dilger <adilger@whamcloud.com>
Date: Thu, 12 Apr 2012 21:23:47 +0000 (-0600)
Subject: e2fsck: improve in-inode xattr checks
X-Git-Tag: v1.42.7.wc1~37
X-Git-Url: https://git.whamcloud.com/gitweb?a=commitdiff_plain;h=b6fe3c51200fa51ce0afa7e80ea94fdfd3880d3f;p=tools%2Fe2fsprogs.git

e2fsck: improve in-inode xattr checks

Add check for in-inode xattr to make sure that it is not referencing
an offset that is beyond the end of the inode.

Signed-off-by: Andreas Dilger <andreas.dilger@intel.com>
---

diff --git a/.gitignore b/.gitignore
index 328df77..45f0cba 100644
--- a/.gitignore
+++ b/.gitignore
@@ -100,6 +100,7 @@ lib/ext2fs/tst_icount
 lib/ext2fs/tst_inline
 lib/ext2fs/tst_inode_size
 lib/ext2fs/tst_iscan
+lib/ext2fs/tst_read_ea
 lib/ext2fs/tst_super_size
 lib/ext2fs/tst_types
 lib/libblkid.a
diff --git a/e2fsck/pass1.c b/e2fsck/pass1.c
index 9c37515..472de1d 100644
--- a/e2fsck/pass1.c
+++ b/e2fsck/pass1.c
@@ -320,6 +320,13 @@ static void check_ea_in_inode(e2fsck_t ctx, struct problem_context *pctx)
 			goto fix;
 		}
 
+		/* Value size cannot be larger than EA space in inode */
+		if (entry->e_value_offs > storage_size ||
+		    entry->e_value_offs + entry->e_value_size > storage_size) {
+			problem = PR_1_INODE_EA_BAD_VALUE;
+			goto fix;
+		}
+
 		hash = ext2fs_ext_attr_hash_entry(entry,
 						  start + entry->e_value_offs);
 
diff --git a/e2fsck/problem.c b/e2fsck/problem.c
index 05ef626..4787883 100644
--- a/e2fsck/problem.c
+++ b/e2fsck/problem.c
@@ -954,6 +954,12 @@ static struct e2fsck_problem problem_table[] = {
 	     "Logical start %b does not match logical start %c at next level.  "),
 	  PROMPT_FIX, 0 },
 
+
+	/* Bad extended attribute value in inode */
+	{ PR_1_INODE_EA_BAD_VALUE,
+	  N_("@a in @i %i is corrupt (@n value)."),
+	  PROMPT_CLEAR, 0},
+
 	/* Pass 1b errors */
 
 	/* Pass 1B: Rescan for duplicate/bad blocks */
diff --git a/e2fsck/problem.h b/e2fsck/problem.h
index aed524d..4f66922 100644
--- a/e2fsck/problem.h
+++ b/e2fsck/problem.h
@@ -561,6 +561,10 @@ struct problem_context {
 /* Index start doesn't match start of next extent down */
 #define PR_1_EXTENT_INDEX_START_INVALID	0x01006D
 
+
+/* Bad extended attribute value in inode */
+#define PR_1_INODE_EA_BAD_VALUE		0x010070
+
 /*
  * Pass 1b errors
  */