diff options
| author | Theodore Ts'o <tytso@mit.edu> | 2018-04-07 00:28:49 -0400 |
|---|---|---|
| committer | Theodore Ts'o <tytso@mit.edu> | 2018-04-07 00:28:49 -0400 |
| commit | 9db53e3fec3413572a2240bd374e76353fab9cbe (patch) | |
| tree | 25c6664b5847d9dab67dfa93467add5d5a995fc6 /e2fsck/pass1.c | |
| parent | c52d7eff8c5fb38900e2c702e92f88c6b934c6f2 (diff) | |
| download | android_external_e2fsprogs-9db53e3fec3413572a2240bd374e76353fab9cbe.tar.gz android_external_e2fsprogs-9db53e3fec3413572a2240bd374e76353fab9cbe.tar.bz2 android_external_e2fsprogs-9db53e3fec3413572a2240bd374e76353fab9cbe.zip | |
libext2fs: add sanity checks for ea_in_inode
An inode containing the value for an extended attribute (aka an
ea_in_inode) must not have the INLINE_DATA flag and must have the
EA_INODE flag set. Enforcing this prevents e2fsck and debugfs crashes
caused by a maliciously crafted file system containing an inode which
has both the EA_INODE and INLINE_DATA flags set, and where that inode
has an extended attribute whose e_value_inum points to itself.
Reported-by: Wen Xu <wen.xu@gatech.edu>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Diffstat (limited to 'e2fsck/pass1.c')
| -rw-r--r-- | e2fsck/pass1.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/e2fsck/pass1.c b/e2fsck/pass1.c index fccd8816..69b3f09e 100644 --- a/e2fsck/pass1.c +++ b/e2fsck/pass1.c @@ -1542,6 +1542,7 @@ void e2fsck_pass1(e2fsck_t ctx) case EXT2_ET_NO_INLINE_DATA: case EXT2_ET_EXT_ATTR_CSUM_INVALID: case EXT2_ET_EA_BAD_VALUE_OFFSET: + case EXT2_ET_EA_INODE_CORRUPTED: /* broken EA or no system.data EA; truncate */ if (fix_problem(ctx, PR_1_INLINE_DATA_NO_ATTR, &pctx)) { |