diff options
| author | Stefan Brüns <stefan.bruens@rwth-aachen.de> | 2016-09-06 04:36:41 +0200 |
|---|---|---|
| committer | Dongjin Kim <tobetter@gmail.com> | 2020-02-10 22:44:41 +0900 |
| commit | 2e852e889f7ec504d7ac5b7c5c2f8de087626679 (patch) | |
| tree | 0dbd246841852ff039a1650af2bc122713c4fff3 /include | |
| parent | e05611ae272200f6f87248e6bc1eaa997aa9f5f5 (diff) | |
| download | u-boot-odroid-c1-2e852e889f7ec504d7ac5b7c5c2f8de087626679.tar.gz | |
ext4: fix possible crash on directory traversal, ignore deleted entries
The following command triggers a segfault in search_dir:
./sandbox/u-boot -c 'host bind 0 ./sandbox/test/fs/3GB.ext4.img ;
ext4write host 0 0 /./foo 0x10'
The following command triggers a segfault in check_filename:
./sandbox/u-boot -c 'host bind 0 ./sandbox/test/fs/3GB.ext4.img ;
ext4write host 0 0 /. 0x10'
"." is the first entry in the directory, thus previous_dir is NULL. The
whole previous_dir block in search_dir seems to be a bad copy from
check_filename(...). As the changed data is not written to disk, the
statement is mostly harmless, save the possible NULL-ptr reference.
Typically a file is unlinked by extending the direntlen of the previous
entry. If the entry is the first entry in the directory block, it is
invalidated by setting inode=0.
The inode==0 case is hard to trigger without crafted filesystems. It only
hits if the first entry in a directory block is deleted and later a lookup
for the entry (by name) is done.
Signed-off-by: Stefan Brüns <stefan.bruens@rwth-aachen.de>
Reviewed-by: Lukasz Majewski <l.majewski@samsung.com>
Diffstat (limited to 'include')
| -rw-r--r-- | include/ext4fs.h | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/include/ext4fs.h b/include/ext4fs.h index 06cef783fa..7b8892f72d 100644 --- a/include/ext4fs.h +++ b/include/ext4fs.h @@ -124,7 +124,7 @@ extern int gindex; int ext4fs_init(void); void ext4fs_deinit(void); -int ext4fs_filename_check(char *filename); +int ext4fs_filename_unlink(char *filename); int ext4fs_write(const char *fname, unsigned char *buffer, unsigned long sizebytes); int ext4_write_file(const char *filename, void *buf, loff_t offset, loff_t len, |