From: Eric Sandeen Ensure that the attribute length itself is valid, and that it does not extend past the mft_record_size, which would result in OOB reads past the mft buffer. For tidiness, move attr_off advance to end of the loop. Signed-off-by: Eric Sandeen --- lib/blkid/probe.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/lib/blkid/probe.c b/lib/blkid/probe.c index 31d048db..ae769a77 100644 --- a/lib/blkid/probe.c +++ b/lib/blkid/probe.c @@ -751,16 +751,22 @@ static int probe_ntfs(struct blkid_probe *probe, label_str[0] = 0; while (1) { + /* Don't read past mft_record_size buf on invalid offset */ + if (attr_off > mft_record_size || sizeof(*attr) > mft_record_size - attr_off) + break; + attr = (struct file_attribute *) (buf_mft + attr_off); attr_len = blkid_le32(attr->len); attr_type = blkid_le32(attr->type); val_off = blkid_le16(attr->value_offset); val_len = blkid_le32(attr->value_len); - attr_off += attr_len; + /* Attribute length must be at least as large as header */ + if (attr_len < sizeof(*attr)) + break; - if ((attr_off > mft_record_size) || - (attr_len == 0)) + /* End of this attribute must be within total record size */ + if (attr_len > mft_record_size - attr_off) break; if (attr_type == MFT_RECORD_ATTR_END) @@ -778,6 +784,8 @@ static int probe_ntfs(struct blkid_probe *probe, } *cp = 0; } + + attr_off += attr_len; } sprintf(uuid_str, "%016llX", blkid_le64(ns->volume_serial)); -- 2.55.0