| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20140718225415.31374.89196.stgit@birch.djwong.org> Date: Fri, 18 Jul 2014 15:54:15 -0700 From: "Darrick J. Wong" <darrick.wong@...cle.com> To: tytso@....edu, darrick.wong@...cle.com Cc: linux-ext4@...r.kernel.org Subject: [PATCH 16/24] e2fsck: don't crash during rehash If a user crafts a carefully constructed filesystem containing a single directory entry block with an invalid checksum and fewer than two entries, and then runs e2fsck to fix the filesystem, fsck will crash when it tries to "compress" the short dir and passes a negative dirent array length to qsort. Therefore, don't allow directory "compression" in this situation. Signed-off-by: Darrick J. Wong <darrick.wong@...cle.com> --- e2fsck/rehash.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/e2fsck/rehash.c b/e2fsck/rehash.c index f75479a..5913ae7 100644 --- a/e2fsck/rehash.c +++ b/e2fsck/rehash.c @@ -848,7 +848,7 @@ retry_nohash: /* Sort the list */ resort: - if (fd.compress) + if (fd.compress && fd.num_array > 1) qsort(fd.harray+2, fd.num_array-2, sizeof(struct hash_entry), hash_cmp); else @@ -867,7 +867,7 @@ resort: } /* Sort non-hashed directories by inode number */ - if (fd.compress) + if (fd.compress && fd.num_array > 1) qsort(fd.harray+2, fd.num_array-2, sizeof(struct hash_entry), ino_cmp); -- To unsubscribe from this list: send the line "unsubscribe linux-ext4" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists