diff options
| author | Edward Adam Davis <eadavis@qq.com> | 2023-12-30 17:00:03 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-03-01 13:26:29 +0100 |
| commit | 6ed6cdbe88334ca3430c5aee7754dc4597498dfb (patch) | |
| tree | 75a5a401f518bbc905a056de08a0e49d25656708 /fs | |
| parent | 5d67a4ff3dfe19aceb185d4c3912796e2d0ac4e1 (diff) | |
fs/ntfs3: Fix oob in ntfs_listxattr
[ Upstream commit 731ab1f9828800df871c5a7ab9ffe965317d3f15 ]
The length of name cannot exceed the space occupied by ea.
Reported-and-tested-by: syzbot+65e940cfb8f99a97aca7@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/ntfs3/xattr.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/fs/ntfs3/xattr.c b/fs/ntfs3/xattr.c index df15e00c2a3a..d98cf7b382bc 100644 --- a/fs/ntfs3/xattr.c +++ b/fs/ntfs3/xattr.c @@ -217,6 +217,9 @@ static ssize_t ntfs_list_ea(struct ntfs_inode *ni, char *buffer, if (!ea->name_len) break; + if (ea->name_len > ea_size) + break; + if (buffer) { /* Check if we can use field ea->name */ if (off + ea_size > size) |