|
 |
0ef434 |
commit f66e6ce4446738c2c7f43d41988a3eb73347e2f5
|
|
|
0ef434 |
Author: Theodore Ts'o <tytso@mit.edu>
|
|
|
0ef434 |
Date: Sat Aug 9 12:24:54 2014 -0400
|
|
|
0ef434 |
|
|
|
0ef434 |
libext2fs: avoid buffer overflow if s_first_meta_bg is too big
|
|
|
0ef434 |
|
|
|
0ef434 |
If s_first_meta_bg is greater than the of number block group
|
|
|
0ef434 |
descriptor blocks, then reading or writing the block group descriptors
|
|
|
0ef434 |
will end up overruning the memory buffer allocated for the
|
|
|
0ef434 |
descriptors. Fix this by limiting first_meta_bg to no more than
|
|
|
0ef434 |
fs->desc_blocks. This doesn't correct the bad s_first_meta_bg value,
|
|
|
0ef434 |
but it avoids causing the e2fsprogs userspace programs from
|
|
|
0ef434 |
potentially crashing.
|
|
|
0ef434 |
|
|
|
0ef434 |
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
|
|
|
0ef434 |
|
|
|
0ef434 |
Index: e2fsprogs-1.42.9/lib/ext2fs/closefs.c
|
|
|
0ef434 |
===================================================================
|
|
|
0ef434 |
--- e2fsprogs-1.42.9.orig/lib/ext2fs/closefs.c
|
|
|
0ef434 |
+++ e2fsprogs-1.42.9/lib/ext2fs/closefs.c
|
|
|
0ef434 |
@@ -336,9 +336,11 @@ errcode_t ext2fs_flush2(ext2_filsys fs,
|
|
|
0ef434 |
* superblocks and group descriptors.
|
|
|
0ef434 |
*/
|
|
|
0ef434 |
group_ptr = (char *) group_shadow;
|
|
|
0ef434 |
- if (fs->super->s_feature_incompat & EXT2_FEATURE_INCOMPAT_META_BG)
|
|
|
0ef434 |
+ if (fs->super->s_feature_incompat & EXT2_FEATURE_INCOMPAT_META_BG) {
|
|
|
0ef434 |
old_desc_blocks = fs->super->s_first_meta_bg;
|
|
|
0ef434 |
- else
|
|
|
0ef434 |
+ if (old_desc_blocks > fs->super->s_first_meta_bg)
|
|
|
0ef434 |
+ old_desc_blocks = fs->desc_blocks;
|
|
|
0ef434 |
+ } else
|
|
|
0ef434 |
old_desc_blocks = fs->desc_blocks;
|
|
|
0ef434 |
|
|
|
0ef434 |
ext2fs_numeric_progress_init(fs, &progress, NULL,
|
|
|
0ef434 |
Index: e2fsprogs-1.42.9/lib/ext2fs/openfs.c
|
|
|
0ef434 |
===================================================================
|
|
|
0ef434 |
--- e2fsprogs-1.42.9.orig/lib/ext2fs/openfs.c
|
|
|
0ef434 |
+++ e2fsprogs-1.42.9/lib/ext2fs/openfs.c
|
|
|
0ef434 |
@@ -348,9 +348,11 @@ errcode_t ext2fs_open2(const char *name,
|
|
|
0ef434 |
#ifdef WORDS_BIGENDIAN
|
|
|
0ef434 |
groups_per_block = EXT2_DESC_PER_BLOCK(fs->super);
|
|
|
0ef434 |
#endif
|
|
|
0ef434 |
- if (fs->super->s_feature_incompat & EXT2_FEATURE_INCOMPAT_META_BG)
|
|
|
0ef434 |
+ if (fs->super->s_feature_incompat & EXT2_FEATURE_INCOMPAT_META_BG) {
|
|
|
0ef434 |
first_meta_bg = fs->super->s_first_meta_bg;
|
|
|
0ef434 |
- else
|
|
|
0ef434 |
+ if (first_meta_bg > fs->desc_blocks)
|
|
|
0ef434 |
+ first_meta_bg = fs->desc_blocks;
|
|
|
0ef434 |
+ } else
|
|
|
0ef434 |
first_meta_bg = fs->desc_blocks;
|
|
|
0ef434 |
if (first_meta_bg) {
|
|
|
0ef434 |
retval = io_channel_read_blk(fs->io, group_block+1,
|