diff mbox series

[3/5] fs/ntfs3: Check for extremely large size of $AttrDef

Message ID 4628ae8a-39e9-ecf8-3efe-193a1ad14d23@paragon-software.com
State New
Headers
Series fs/ntfs3: Refactoring and bugfix |

Commit Message

Konstantin Komarov Dec. 30, 2022, 11:25 a.m. UTC 
  Added additional checking for size of $AttrDef.
Added comment.

Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
---
  fs/ntfs3/super.c | 10 +++++++++-
  1 file changed, 9 insertions(+), 1 deletion(-)

      if (!t) {
diff mbox series

Patch

diff --git a/fs/ntfs3/super.c b/fs/ntfs3/super.c
index ef4ea3f21905..0967035146ce 100644
--- a/fs/ntfs3/super.c
+++ b/fs/ntfs3/super.c
@@ -1185,10 +1185,18 @@  static int ntfs_fill_super(struct super_block 
*sb, struct fs_context *fc)
          goto out;
      }

-    if (inode->i_size < sizeof(struct ATTR_DEF_ENTRY)) {
+    /*
+     * Typical $AttrDef contains up to 20 entries.
+     * Check for extremely large size.
+     */
+    if (inode->i_size < sizeof(struct ATTR_DEF_ENTRY) ||
+        inode->i_size > 100 * sizeof(struct ATTR_DEF_ENTRY)) {
+        ntfs_err(sb, "Looks like $AttrDef is corrupted (size=%llu).",
+             inode->i_size);
          err = -EINVAL;
          goto put_inode_out;
      }
+
      bytes = inode->i_size;
      sbi->def_table = t = kmalloc(bytes, GFP_NOFS | __GFP_NOWARN);