linux-ext4.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH 1/6] libext2fs: avoid buffer overflow if s_first_meta_bg is too big
@ 2014-08-09 17:10 Theodore Ts'o
  2014-08-09 17:10 ` [PATCH 2/6] e2fsck: fix file systems with an overly large s_first_meta_bg Theodore Ts'o
                   ` (4 more replies)
  0 siblings, 5 replies; 6+ messages in thread
From: Theodore Ts'o @ 2014-08-09 17:10 UTC (permalink / raw)
  To: Ext4 Developers List; +Cc: antymat+debian, 756922, Theodore Ts'o

If s_first_meta_bg is greater than the number block group descriptor
blocks, then reading or writing the block group descriptors will end
up overruning the memory buffer allocated for the descriptors.  Fix
this by limiting first_meta_bg to no more than fs->desc_blocks.  This
doesn't correct the bad s_first_meta_bg value, but it avoids causing
the e2fsprogs userspace programs from potentially crashing.

Signed-off-by: Theodore Ts'o <tytso@mit.edu>
---
 lib/ext2fs/closefs.c | 6 ++++--
 lib/ext2fs/openfs.c  | 6 ++++--
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/lib/ext2fs/closefs.c b/lib/ext2fs/closefs.c
index 4599eef..1f99113 100644
--- a/lib/ext2fs/closefs.c
+++ b/lib/ext2fs/closefs.c
@@ -344,9 +344,11 @@ errcode_t ext2fs_flush2(ext2_filsys fs, int flags)
 	 * superblocks and group descriptors.
 	 */
 	group_ptr = (char *) group_shadow;
-	if (fs->super->s_feature_incompat & EXT2_FEATURE_INCOMPAT_META_BG)
+	if (fs->super->s_feature_incompat & EXT2_FEATURE_INCOMPAT_META_BG) {
 		old_desc_blocks = fs->super->s_first_meta_bg;
-	else
+		if (old_desc_blocks > fs->super->s_first_meta_bg)
+			old_desc_blocks = fs->desc_blocks;
+	} else
 		old_desc_blocks = fs->desc_blocks;
 
 	ext2fs_numeric_progress_init(fs, &progress, NULL,
diff --git a/lib/ext2fs/openfs.c b/lib/ext2fs/openfs.c
index a1a3517..ba501e6 100644
--- a/lib/ext2fs/openfs.c
+++ b/lib/ext2fs/openfs.c
@@ -378,9 +378,11 @@ errcode_t ext2fs_open2(const char *name, const char *io_options,
 #ifdef WORDS_BIGENDIAN
 	groups_per_block = EXT2_DESC_PER_BLOCK(fs->super);
 #endif
-	if (fs->super->s_feature_incompat & EXT2_FEATURE_INCOMPAT_META_BG)
+	if (fs->super->s_feature_incompat & EXT2_FEATURE_INCOMPAT_META_BG) {
 		first_meta_bg = fs->super->s_first_meta_bg;
-	else
+		if (first_meta_bg > fs->desc_blocks)
+			first_meta_bg = fs->desc_blocks;
+	} else
 		first_meta_bg = fs->desc_blocks;
 	if (first_meta_bg) {
 		retval = io_channel_read_blk(fs->io, group_block +
-- 
2.0.0


^ permalink raw reply related	[flat|nested] 6+ messages in thread

end of thread, other threads:[~2014-08-09 17:10 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-08-09 17:10 [PATCH 1/6] libext2fs: avoid buffer overflow if s_first_meta_bg is too big Theodore Ts'o
2014-08-09 17:10 ` [PATCH 2/6] e2fsck: fix file systems with an overly large s_first_meta_bg Theodore Ts'o
2014-08-09 17:10 ` [PATCH 3/6] resize2fs: disable the meta_bg feature if necessary Theodore Ts'o
2014-08-09 17:10 ` [PATCH 4/6] tests: make sure MKE2FS_FIRST_META_BG is unset while running tests Theodore Ts'o
2014-08-09 17:10 ` [PATCH 5/6] tests: add f_first_meta_bg_too_big test Theodore Ts'o
2014-08-09 17:10 ` [PATCH 6/6] tests: add the r_meta_bg_shrink test Theodore Ts'o

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).