diff options
| author | Theodore Ts'o <tytso@mit.edu> | 2018-08-01 12:36:52 -0400 |
|---|---|---|
| committer | Theodore Ts'o <tytso@mit.edu> | 2018-08-01 12:36:52 -0400 |
| commit | 7d95178c77014dbd8dce36ee40bbbc5e6c121ff5 (patch) | |
| tree | e5e343d20f0e2ba6efb9eaf970683c4ebc1c68df /fs/ext4/xattr.c | |
| parent | 5ef2a69993676a0dfd49bf60ae1323eb8a288366 (diff) | |
| download | linux-next-7d95178c77014dbd8dce36ee40bbbc5e6c121ff5.tar.gz | |
ext4: check for NUL characters in extended attribute's name
Extended attribute names are defined to be NUL-terminated, so the name
must not contain a NUL character. This is important because there are
places when remove extended attribute, the code uses strlen to
determine the length of the entry. That should probably be fixed at
some point, but code is currently really messy, so the simplest fix
for now is to simply validate that the extended attributes are sane.
https://bugzilla.kernel.org/show_bug.cgi?id=200401
Reported-by: Wen Xu <wen.xu@gatech.edu>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@vger.kernel.org
Diffstat (limited to 'fs/ext4/xattr.c')
| -rw-r--r-- | fs/ext4/xattr.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c index 723df14f4084..f36fc5d5b257 100644 --- a/fs/ext4/xattr.c +++ b/fs/ext4/xattr.c @@ -190,6 +190,8 @@ ext4_xattr_check_entries(struct ext4_xattr_entry *entry, void *end, struct ext4_xattr_entry *next = EXT4_XATTR_NEXT(e); if ((void *)next >= end) return -EFSCORRUPTED; + if (strnlen(e->e_name, e->e_name_len) != e->e_name_len) + return -EFSCORRUPTED; e = next; } |