diff options
| author | Dan Carpenter <dan.carpenter@linaro.org> | 2025-02-16 23:52:10 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-04-10 14:44:30 +0200 |
| commit | b9982065b82b4177ba3a7a72ce18c84921f7494d (patch) | |
| tree | e60b82545d3cdadbc98865eb11b53c2e31458861 /fs | |
| parent | 4d0f4f42922a832388a0c2fe5204c0a1037ff786 (diff) | |
| download | linux-b9982065b82b4177ba3a7a72ce18c84921f7494d.tar.gz linux-b9982065b82b4177ba3a7a72ce18c84921f7494d.tar.bz2 linux-b9982065b82b4177ba3a7a72ce18c84921f7494d.zip | |
fs/ntfs3: Prevent integer overflow in hdr_first_de()
[ Upstream commit 6bb81b94f7a9cba6bde9a905cef52a65317a8b04 ]
The "de_off" and "used" variables come from the disk so they both need to
check. The problem is that on 32bit systems if they're both greater than
UINT_MAX - 16 then the check does work as intended because of an integer
overflow.
Fixes: 60ce8dfde035 ("fs/ntfs3: Fix wrong if in hdr_first_de")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/ntfs3/ntfs.h | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/ntfs3/ntfs.h b/fs/ntfs3/ntfs.h index 241f2ffdd920..1ff13b6f9613 100644 --- a/fs/ntfs3/ntfs.h +++ b/fs/ntfs3/ntfs.h @@ -717,7 +717,7 @@ static inline struct NTFS_DE *hdr_first_de(const struct INDEX_HDR *hdr) struct NTFS_DE *e; u16 esize; - if (de_off >= used || de_off + sizeof(struct NTFS_DE) > used ) + if (de_off >= used || size_add(de_off, sizeof(struct NTFS_DE)) > used) return NULL; e = Add2Ptr(hdr, de_off); |