Unverified Commit e9432b9d authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!10454 fs/ntfs3: Validate ff offset 

Merge Pull Request from: @ci-robot 
 
PR sync from: Wang Zhaolong <wangzhaolong1@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/AFZTPWKVYZTPYJ75S7TQXSHCW3JLEPV3/ 
 
https://gitee.com/src-openeuler/kernel/issues/IAG8RW 
 
Link:https://gitee.com/openeuler/kernel/pulls/10454

 

Reviewed-by: default avatarYang Yingliang <yangyingliang@huawei.com>
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
parents 4ca5cfae a765caed

fs/ntfs3/fslog.c

+5 −1
Original line number Diff line number Diff line
@@ -722,7 +722,8 @@ static bool check_rstbl(const struct RESTART_TABLE *rt, size_t bytes) 


	if (!rsize || rsize > bytes ||

	    rsize + sizeof(struct RESTART_TABLE) > bytes || bytes < ts ||

	    le16_to_cpu(rt->total) > ne || ff > ts || lf > ts ||

	    le16_to_cpu(rt->total) > ne ||

			ff > ts - sizeof(__le32) || lf > ts - sizeof(__le32) ||

	    (ff && ff < sizeof(struct RESTART_TABLE)) ||

	    (lf && lf < sizeof(struct RESTART_TABLE))) {

		return false;
@@ -752,6 +753,9 @@ static bool check_rstbl(const struct RESTART_TABLE *rt, size_t bytes) 
			return false;



		off = le32_to_cpu(*(__le32 *)Add2Ptr(rt, off));



		if (off > ts - sizeof(__le32))

			return false;

	}



	return true;