Skip to content
Commit 35f75d2a authored by Richard Weinberger's avatar Richard Weinberger Committed by Tom Rini
Browse files

ext4: Fix integer overflow in ext4fs_read_symlink()



While zalloc() takes a size_t type, adding 1 to the le32 variable
will overflow.
A carefully crafted ext4 filesystem can exhibit an inode size of 0xffffffff
and as consequence zalloc() will do a zero allocation.

Later in the function the inode size is again used for copying data.
So an attacker can overwrite memory.

Avoid the overflow by using the __builtin_add_overflow() helper.

Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
parent 048d795b
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment