summaryrefslogtreecommitdiff
path: root/fs
diff options
context:
space:
mode:
authorTheodore Ts'o <tytso@mit.edu>2018-08-01 12:36:52 -0400
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2018-09-05 09:18:37 +0200
commitac92782e4ef6fc9f4694bdc9e1b5d5bfb72027ff (patch)
treee539f3163298c0cd6c0a83d939068387327afce2 /fs
parentf4d76c934b4dcb6f068d2c850c35ebac5faff021 (diff)
ext4: check for NUL characters in extended attribute's name
commit 7d95178c77014dbd8dce36ee40bbbc5e6c121ff5 upstream. Extended attribute names are defined to be NUL-terminated, so the name must not contain a NUL character. This is important because there are places when remove extended attribute, the code uses strlen to determine the length of the entry. That should probably be fixed at some point, but code is currently really messy, so the simplest fix for now is to simply validate that the extended attributes are sane. https://bugzilla.kernel.org/show_bug.cgi?id=200401 Reported-by: Wen Xu <wen.xu@gatech.edu> Signed-off-by: Theodore Ts'o <tytso@mit.edu> Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'fs')
-rw-r--r--fs/ext4/xattr.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
index c7cad05aed27..9fb2a751fce4 100644
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -197,6 +197,8 @@ ext4_xattr_check_names(struct ext4_xattr_entry *entry, void *end,
struct ext4_xattr_entry *next = EXT4_XATTR_NEXT(e);
if ((void *)next >= end)
return -EFSCORRUPTED;
+ if (strnlen(e->e_name, e->e_name_len) != e->e_name_len)
+ return -EFSCORRUPTED;
e = next;
}