diff options
| author | Ian Ray <ian.ray@ge.com> | 2017-11-08 15:35:10 +0000 |
|---|---|---|
| committer | Stefano Babic <sbabic@denx.de> | 2017-11-20 09:58:31 +0100 |
| commit | ecdfb4195b20eb2dcde3c4083170016c13c69e8b (patch) | |
| tree | 7781fc0c6a8fa9e6c3019fd369e1570a45db13cb /fs/ext4/ext4fs.c | |
| parent | 2feec4eafd40b4b121a0f7d7f602e25a39d9d403 (diff) | |
| download | u-boot-ecdfb4195b20eb2dcde3c4083170016c13c69e8b.tar.gz | |
ext4: recover from filesystem corruption when reading
Some fixes when reading EXT files and directory entries were identified
after using e2fuzz to corrupt an EXT3 filesystem:
- Stop reading directory entries if the offset becomes badly aligned.
- Avoid overwriting memory by clamping the length used to zero the buffer
in ext4fs_read_file. Also sanity check blocksize.
Signed-off-by: Ian Ray <ian.ray@ge.com>
Signed-off-by: Martyn Welch <martyn.welch@collabora.co.uk>
Reviewed-by: Stefano Babic <sbabic@denx.de>
Diffstat (limited to 'fs/ext4/ext4fs.c')
| -rw-r--r-- | fs/ext4/ext4fs.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/fs/ext4/ext4fs.c b/fs/ext4/ext4fs.c index b0c7303aa4..9ee2caf2fa 100644 --- a/fs/ext4/ext4fs.c +++ b/fs/ext4/ext4fs.c @@ -64,6 +64,9 @@ int ext4fs_read_file(struct ext2fs_node *node, loff_t pos, char *delayed_buf = NULL; short status; + if (blocksize <= 0) + return -1; + /* Adjust len so it we can't read past the end of the file. */ if (len + pos > filesize) len = (filesize - pos); @@ -127,6 +130,7 @@ int ext4fs_read_file(struct ext2fs_node *node, loff_t pos, (blockend >> log2blksz); } } else { + int n; if (previous_block_number != -1) { /* spill */ status = ext4fs_devread(delayed_start, @@ -137,7 +141,11 @@ int ext4fs_read_file(struct ext2fs_node *node, loff_t pos, return -1; previous_block_number = -1; } - memset(buf, 0, blocksize - skipfirst); + /* Zero no more than `len' bytes. */ + n = blocksize - skipfirst; + if (n > len) + n = len; + memset(buf, 0, n); } buf += blocksize - skipfirst; } |