From ecdfb4195b20eb2dcde3c4083170016c13c69e8b Mon Sep 17 00:00:00 2001 From: Ian Ray Date: Wed, 8 Nov 2017 15:35:10 +0000 Subject: ext4: recover from filesystem corruption when reading Some fixes when reading EXT files and directory entries were identified after using e2fuzz to corrupt an EXT3 filesystem: - Stop reading directory entries if the offset becomes badly aligned. - Avoid overwriting memory by clamping the length used to zero the buffer in ext4fs_read_file. Also sanity check blocksize. Signed-off-by: Ian Ray Signed-off-by: Martyn Welch Reviewed-by: Stefano Babic --- fs/ext4/ext4fs.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) (limited to 'fs/ext4/ext4fs.c') diff --git a/fs/ext4/ext4fs.c b/fs/ext4/ext4fs.c index b0c7303aa4..9ee2caf2fa 100644 --- a/fs/ext4/ext4fs.c +++ b/fs/ext4/ext4fs.c @@ -64,6 +64,9 @@ int ext4fs_read_file(struct ext2fs_node *node, loff_t pos, char *delayed_buf = NULL; short status; + if (blocksize <= 0) + return -1; + /* Adjust len so it we can't read past the end of the file. */ if (len + pos > filesize) len = (filesize - pos); @@ -127,6 +130,7 @@ int ext4fs_read_file(struct ext2fs_node *node, loff_t pos, (blockend >> log2blksz); } } else { + int n; if (previous_block_number != -1) { /* spill */ status = ext4fs_devread(delayed_start, @@ -137,7 +141,11 @@ int ext4fs_read_file(struct ext2fs_node *node, loff_t pos, return -1; previous_block_number = -1; } - memset(buf, 0, blocksize - skipfirst); + /* Zero no more than `len' bytes. */ + n = blocksize - skipfirst; + if (n > len) + n = len; + memset(buf, 0, n); } buf += blocksize - skipfirst; } -- cgit