diff options
| author | Ian Ray <ian.ray@ge.com> | 2017-11-08 15:35:10 +0000 |
|---|---|---|
| committer | Stefano Babic <sbabic@denx.de> | 2017-11-20 09:58:31 +0100 |
| commit | ecdfb4195b20eb2dcde3c4083170016c13c69e8b (patch) | |
| tree | 7781fc0c6a8fa9e6c3019fd369e1570a45db13cb /fs | |
| parent | 2feec4eafd40b4b121a0f7d7f602e25a39d9d403 (diff) | |
ext4: recover from filesystem corruption when reading
Some fixes when reading EXT files and directory entries were identified
after using e2fuzz to corrupt an EXT3 filesystem:
- Stop reading directory entries if the offset becomes badly aligned.
- Avoid overwriting memory by clamping the length used to zero the buffer
in ext4fs_read_file. Also sanity check blocksize.
Signed-off-by: Ian Ray <ian.ray@ge.com>
Signed-off-by: Martyn Welch <martyn.welch@collabora.co.uk>
Reviewed-by: Stefano Babic <sbabic@denx.de>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/ext4/ext4_common.c | 10 | ||||
| -rw-r--r-- | fs/ext4/ext4fs.c | 10 |
2 files changed, 19 insertions, 1 deletions
diff --git a/fs/ext4/ext4_common.c b/fs/ext4/ext4_common.c index 31952f48b90..dac95453650 100644 --- a/fs/ext4/ext4_common.c +++ b/fs/ext4/ext4_common.c @@ -660,6 +660,11 @@ static int search_dir(struct ext2_inode *parent_inode, char *dirname) offset = 0; do { + if (offset & 3) { + printf("Badly aligned ext2_dirent\n"); + break; + } + dir = (struct ext2_dirent *)(block_buffer + offset); direntname = (char*)(dir) + sizeof(struct ext2_dirent); @@ -880,6 +885,11 @@ static int unlink_filename(char *filename, unsigned int blknr) offset = 0; do { + if (offset & 3) { + printf("Badly aligned ext2_dirent\n"); + break; + } + previous_dir = dir; dir = (struct ext2_dirent *)(block_buffer + offset); direntname = (char *)(dir) + sizeof(struct ext2_dirent); diff --git a/fs/ext4/ext4fs.c b/fs/ext4/ext4fs.c index b0c7303aa41..9ee2caf2fa1 100644 --- a/fs/ext4/ext4fs.c +++ b/fs/ext4/ext4fs.c @@ -64,6 +64,9 @@ int ext4fs_read_file(struct ext2fs_node *node, loff_t pos, char *delayed_buf = NULL; short status; + if (blocksize <= 0) + return -1; + /* Adjust len so it we can't read past the end of the file. */ if (len + pos > filesize) len = (filesize - pos); @@ -127,6 +130,7 @@ int ext4fs_read_file(struct ext2fs_node *node, loff_t pos, (blockend >> log2blksz); } } else { + int n; if (previous_block_number != -1) { /* spill */ status = ext4fs_devread(delayed_start, @@ -137,7 +141,11 @@ int ext4fs_read_file(struct ext2fs_node *node, loff_t pos, return -1; previous_block_number = -1; } - memset(buf, 0, blocksize - skipfirst); + /* Zero no more than `len' bytes. */ + n = blocksize - skipfirst; + if (n > len) + n = len; + memset(buf, 0, n); } buf += blocksize - skipfirst; } |