[PATCH 2/4] blkid: probe_ntfs: validate on-disk attribute size/length

[Eric Sandeen <sandeen@redhat.com>]

From: Eric Sandeen <esandeen@redhat.com>

Ensure that the attribute length itself is valid, and that it does not
extend past the mft_record_size, which would result in OOB reads past
the mft buffer.

For tidiness, move attr_off advance to end of the loop.

Signed-off-by: Eric Sandeen <sandeen@redhat.com>
---
 lib/blkid/probe.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/lib/blkid/probe.c b/lib/blkid/probe.c
index 31d048db..ae769a77 100644
--- a/lib/blkid/probe.c
+++ b/lib/blkid/probe.c
@@ -751,16 +751,22 @@ static int probe_ntfs(struct blkid_probe *probe,
 	label_str[0] = 0;
 
 	while (1) {
+		/* Don't read past mft_record_size buf on invalid offset */
+		if (attr_off > mft_record_size || sizeof(*attr) > mft_record_size - attr_off)
+			break;
+
 		attr = (struct file_attribute *) (buf_mft + attr_off);
 		attr_len = blkid_le32(attr->len);
 		attr_type = blkid_le32(attr->type);
 		val_off = blkid_le16(attr->value_offset);
 		val_len = blkid_le32(attr->value_len);
 
-		attr_off += attr_len;
+		/* Attribute length must be at least as large as header */
+		if (attr_len < sizeof(*attr))
+			break;
 
-		if ((attr_off > mft_record_size) ||
-		    (attr_len == 0))
+		/* End of this attribute must be within total record size */
+		if (attr_len > mft_record_size - attr_off)
 			break;
 
 		if (attr_type == MFT_RECORD_ATTR_END)
@@ -778,6 +784,8 @@ static int probe_ntfs(struct blkid_probe *probe,
 			}
 			*cp = 0;
 		}
+
+		attr_off += attr_len;
 	}
 
 	sprintf(uuid_str, "%016llX", blkid_le64(ns->volume_serial));
-- 
2.55.0