From: Eric Sandeen Ensure that the volume name fits within the attribute offset Signed-off-by: Eric Sandeen --- lib/blkid/probe.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/lib/blkid/probe.c b/lib/blkid/probe.c index ae769a77..87167171 100644 --- a/lib/blkid/probe.c +++ b/lib/blkid/probe.c @@ -773,6 +773,13 @@ static int probe_ntfs(struct blkid_probe *probe, break; if (attr_type == MFT_RECORD_ATTR_VOLUME_NAME) { + /* Value length must be multiple of two (UTF-16LE) */ + if (val_len & 1) + break; + /* End of value must be within attr length */ + if (val_off > attr_len || val_len > attr_len - val_off) + break; + if (val_len > sizeof(label_str)) val_len = sizeof(label_str)-1; -- 2.55.0