diff options
| author | Lizhi Xu <lizhi.xu@windriver.com> | 2025-06-06 13:16:16 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-08-28 16:25:51 +0200 |
| commit | f99eb9a641f4ef927d8724f4966dcfd1f0e9f835 (patch) | |
| tree | 9d616e5e9d248cf17a91387a8c218a94f8e8e8ff /fs/ntfs3 | |
| parent | 889786c24f7345a3f7a543d027bb0f1d5ba2bfe6 (diff) | |
| download | linux-f99eb9a641f4ef927d8724f4966dcfd1f0e9f835.tar.gz linux-f99eb9a641f4ef927d8724f4966dcfd1f0e9f835.tar.bz2 linux-f99eb9a641f4ef927d8724f4966dcfd1f0e9f835.zip | |
fs/ntfs3: Add sanity check for file name
[ Upstream commit e841ecb139339602bc1853f5f09daa5d1ea920a2 ]
The length of the file name should be smaller than the directory entry size.
Reported-by: syzbot+598057afa0f49e62bd23@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=598057afa0f49e62bd23
Signed-off-by: Lizhi Xu <lizhi.xu@windriver.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'fs/ntfs3')
| -rw-r--r-- | fs/ntfs3/dir.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/fs/ntfs3/dir.c b/fs/ntfs3/dir.c index a4ab0164d150..c49e64ebbd0a 100644 --- a/fs/ntfs3/dir.c +++ b/fs/ntfs3/dir.c @@ -304,6 +304,9 @@ static inline bool ntfs_dir_emit(struct ntfs_sb_info *sbi, if (sbi->options->nohidden && (fname->dup.fa & FILE_ATTRIBUTE_HIDDEN)) return true; + if (fname->name_len + sizeof(struct NTFS_DE) > le16_to_cpu(e->size)) + return true; + name_len = ntfs_utf16_to_nls(sbi, fname->name, fname->name_len, name, PATH_MAX); if (name_len <= 0) { |