[PATCH 4/8] libext2fs: fix ea loop in ext2fs_ext_attr_block_rehash

[Eric Sandeen <sandeen@redhat.com>]

From: Andreas Gruenbacher <agruenba@redhat.com>

Fix the same problems as in check_ea_in_inode().

Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Eric Sandeen <sandeen@redhat.com>
---
 lib/ext2fs/ext_attr.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/lib/ext2fs/ext_attr.c b/lib/ext2fs/ext_attr.c
index 7723d0f9..914bff1d 100644
--- a/lib/ext2fs/ext_attr.c
+++ b/lib/ext2fs/ext_attr.c
@@ -163,10 +163,17 @@ void ext2fs_ext_attr_block_rehash(struct ext2_ext_attr_header *header,
 				  struct ext2_ext_attr_entry *end)
 {
 	struct ext2_ext_attr_entry *here;
+	unsigned int remain;
 	__u32 hash = 0;
 
 	here = (struct ext2_ext_attr_entry *)(header+1);
-	while (here < end && !EXT2_EXT_IS_LAST_ENTRY(here)) {
+	/* take finish entry 0UL into account */
+	remain = (void *)end - (void *)here - sizeof(__u32);
+	while (!EXT2_EXT_IS_LAST_ENTRY(here)) {
+		/* entry->e_name_len is within the first four bytes */
+		if (EXT2_EXT_ATTR_LEN(here->e_name_len) > remain)
+			break;
+		remain -= EXT2_EXT_ATTR_LEN(here->e_name_len);
 		if (!here->e_hash) {
 			/* Block is not shared if an entry's hash value == 0 */
 			hash = 0;
-- 
2.55.0