From ecdfb4195b20eb2dcde3c4083170016c13c69e8b Mon Sep 17 00:00:00 2001 From: Ian Ray Date: Wed, 8 Nov 2017 15:35:10 +0000 Subject: ext4: recover from filesystem corruption when reading Some fixes when reading EXT files and directory entries were identified after using e2fuzz to corrupt an EXT3 filesystem: - Stop reading directory entries if the offset becomes badly aligned. - Avoid overwriting memory by clamping the length used to zero the buffer in ext4fs_read_file. Also sanity check blocksize. Signed-off-by: Ian Ray Signed-off-by: Martyn Welch Reviewed-by: Stefano Babic --- fs/ext4/ext4_common.c | 10 ++++++++++ 1 file changed, 10 insertions(+) (limited to 'fs/ext4/ext4_common.c') diff --git a/fs/ext4/ext4_common.c b/fs/ext4/ext4_common.c index 31952f48b9..dac9545365 100644 --- a/fs/ext4/ext4_common.c +++ b/fs/ext4/ext4_common.c @@ -660,6 +660,11 @@ static int search_dir(struct ext2_inode *parent_inode, char *dirname) offset = 0; do { + if (offset & 3) { + printf("Badly aligned ext2_dirent\n"); + break; + } + dir = (struct ext2_dirent *)(block_buffer + offset); direntname = (char*)(dir) + sizeof(struct ext2_dirent); @@ -880,6 +885,11 @@ static int unlink_filename(char *filename, unsigned int blknr) offset = 0; do { + if (offset & 3) { + printf("Badly aligned ext2_dirent\n"); + break; + } + previous_dir = dir; dir = (struct ext2_dirent *)(block_buffer + offset); direntname = (char *)(dir) + sizeof(struct ext2_dirent); -- cgit v1.2.3