Some fixes when reading EXT files and directory entries were identified
after using e2fuzz to corrupt an EXT3 filesystem:
- Stop reading directory entries if the offset becomes badly aligned.
- Avoid overwriting memory by clamping the length used to zero the buffer
in ext4fs_read_file. Also sanity check blocksize.
Signed-off-by: Ian Ray <ian.ray@ge.com>
Signed-off-by: Martyn Welch <martyn.welch@collabora.co.uk>
Reviewed-by: Stefano Babic <sbabic@denx.de>
offset = 0;
do {
+ if (offset & 3) {
+ printf("Badly aligned ext2_dirent\n");
+ break;
+ }
+
dir = (struct ext2_dirent *)(block_buffer + offset);
direntname = (char*)(dir) + sizeof(struct ext2_dirent);
offset = 0;
do {
+ if (offset & 3) {
+ printf("Badly aligned ext2_dirent\n");
+ break;
+ }
+
previous_dir = dir;
dir = (struct ext2_dirent *)(block_buffer + offset);
direntname = (char *)(dir) + sizeof(struct ext2_dirent);
char *delayed_buf = NULL;
short status;
+ if (blocksize <= 0)
+ return -1;
+
/* Adjust len so it we can't read past the end of the file. */
if (len + pos > filesize)
len = (filesize - pos);
(blockend >> log2blksz);
}
} else {
+ int n;
if (previous_block_number != -1) {
/* spill */
status = ext4fs_devread(delayed_start,
return -1;
previous_block_number = -1;
}
- memset(buf, 0, blocksize - skipfirst);
+ /* Zero no more than `len' bytes. */
+ n = blocksize - skipfirst;
+ if (n > len)
+ n = len;
+ memset(buf, 0, n);
}
buf += blocksize - skipfirst;
}