linux-ext4 - [PATCH] libext2fs: Add sanity checks to ext2fs_{block,inode}_alloc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1232659984-10183-3-git-send-email-tytso@mit.edu>
Date:	Thu, 22 Jan 2009 16:33:03 -0500
From:	Theodore Ts'o <tytso@....edu>
To:	Ext4 Developers List <linux-ext4@...r.kernel.org>
Cc:	Eric Sesterhenn <snakebyte@....de>, Theodore Ts'o <tytso@....edu>
Subject: [PATCH] libext2fs: Add sanity checks to ext2fs_{block,inode}_alloc_stats

If ext2fs_inode_alloc_stats2() or ext2fs_block_alloc_stats() is passed
an insanely large inode or block number, it's possible for these
functions to overrun an array boundary and cause the calling program
to crash with a memory error.

Detect this case, and since these functions don't return an error
code, print a warning message, much like we do in ext2fs_warn_bitmap2().

Signed-off-by: "Theodore Ts'o" <tytso@....edu>
---
 lib/ext2fs/alloc_stats.c |   14 ++++++++++++++
 1 files changed, 14 insertions(+), 0 deletions(-)

diff --git a/lib/ext2fs/alloc_stats.c b/lib/ext2fs/alloc_stats.c
index 97661dc..d523b43 100644
--- a/lib/ext2fs/alloc_stats.c
+++ b/lib/ext2fs/alloc_stats.c
@@ -20,6 +20,13 @@ void ext2fs_inode_alloc_stats2(ext2_filsys fs, ext2_ino_t ino,
 {
 	int	group = ext2fs_group_of_ino(fs, ino);
 
+#ifndef OMIT_COM_ERR
+	if (ino > fs->super->s_inodes_count) {
+		com_err("ext2fs_inode_alloc_stats2", 0,
+			"Illegal inode number: %lu", ino);
+		return;
+	}
+#endif
 	if (inuse > 0)
 		ext2fs_mark_inode_bitmap(fs->inode_map, ino);
 	else
@@ -58,6 +65,13 @@ void ext2fs_block_alloc_stats(ext2_filsys fs, blk_t blk, int inuse)
 {
 	int	group = ext2fs_group_of_blk(fs, blk);
 
+#ifndef OMIT_COM_ERR
+	if (blk >= fs->super->s_blocks_count) {
+		com_err("ext2fs_block_alloc_stats2", 0,
+			"Illegal block number: %lu", blk);
+		return;
+	}
+#endif
 	if (inuse > 0)
 		ext2fs_mark_block_bitmap(fs->block_map, blk);
 	else
-- 
1.6.0.4.8.g36f27.dirty

--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html