Skip to content

Commit

Permalink
fs/ntfs3: Add null pointer checks
Browse files Browse the repository at this point in the history
commit fc49924 upstream.

Added null pointer checks in function ntfs_security_init.
Also added le32_to_cpu in functions ntfs_security_init and indx_read.

Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Cc: "Doebel, Bjoern" <doebel@amazon.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Konstantin Komarov authored and Greg Kroah-Hartman committed Feb 23, 2024
1 parent d028cc6 commit 9020513
Showing 2 changed files with 12 additions and 7 deletions.
16 changes: 10 additions & 6 deletions fs/ntfs3/fsntfs.c
Original file line number Diff line number Diff line change
@@ -1842,10 +1842,12 @@ int ntfs_security_init(struct ntfs_sb_info *sbi)
goto out;
}

root_sdh = resident_data_ex(attr, sizeof(struct INDEX_ROOT));
if (root_sdh->type != ATTR_ZERO ||
if(!(root_sdh = resident_data_ex(attr, sizeof(struct INDEX_ROOT))) ||
root_sdh->type != ATTR_ZERO ||
root_sdh->rule != NTFS_COLLATION_TYPE_SECURITY_HASH ||
offsetof(struct INDEX_ROOT, ihdr) + root_sdh->ihdr.used > attr->res.data_size) {
offsetof(struct INDEX_ROOT, ihdr) +
le32_to_cpu(root_sdh->ihdr.used) >
le32_to_cpu(attr->res.data_size)) {
err = -EINVAL;
goto out;
}
@@ -1861,10 +1863,12 @@ int ntfs_security_init(struct ntfs_sb_info *sbi)
goto out;
}

root_sii = resident_data_ex(attr, sizeof(struct INDEX_ROOT));
if (root_sii->type != ATTR_ZERO ||
if(!(root_sii = resident_data_ex(attr, sizeof(struct INDEX_ROOT))) ||
root_sii->type != ATTR_ZERO ||
root_sii->rule != NTFS_COLLATION_TYPE_UINT ||
offsetof(struct INDEX_ROOT, ihdr) + root_sii->ihdr.used > attr->res.data_size) {
offsetof(struct INDEX_ROOT, ihdr) +
le32_to_cpu(root_sii->ihdr.used) >
le32_to_cpu(attr->res.data_size)) {
err = -EINVAL;
goto out;
}
3 changes: 2 additions & 1 deletion fs/ntfs3/index.c
Original file line number Diff line number Diff line change
@@ -1097,7 +1097,8 @@ int indx_read(struct ntfs_index *indx, struct ntfs_inode *ni, CLST vbn,
}

/* check for index header length */
if (offsetof(struct INDEX_BUFFER, ihdr) + ib->ihdr.used > bytes) {
if (offsetof(struct INDEX_BUFFER, ihdr) + le32_to_cpu(ib->ihdr.used) >
bytes) {
err = -EINVAL;
goto out;
}

0 comments on commit 9020513

Please sign in to comment.