Skip to contentSkip to conversation

Validate e_value_offs for in-inode EAs

PATCH New Girish 1 participant 1 message Feb 12, 2009

lore
Share & tools
lore

Girish

author
#0 lore raw

PATCH 1/1 Validate e_value_offs for in-inode EAs

Hi Ted,

We came across a corruption in which e_value_offs for an in-inode EA was corrupt and the overflow was causing a segfault. We should validate e_value_offs for in-inode EAs as well.

I have also attached the regression test for this problem.

Signature · 2 lines
Thanks,
Girish
e2fsck/pass1.c +7 -0
Index: e2fsprogs-1.41.1/e2fsck/pass1.c
===================================================================
@@ -318,6 +318,13 @@
 			goto fix;
 		}
 
+		/* Value size cannot be larger than EA space in inode */
+		if (entry->e_value_offs > storage_size ||
+		    entry->e_value_offs + entry->e_value_size > storage_size) {
+			problem = PR_1_INODE_EA_BAD_VALUE;
+			goto fix;
+		}
+
 		hash = ext2fs_ext_attr_hash_entry(entry,
 						  start + entry->e_value_offs);
 
e2fsck/problem.c +5 -0
Index: e2fsprogs-1.41.1/e2fsck/problem.c
===================================================================
@@ -908,6 +908,11 @@
 	  N_("Pass 1C: Scanning directories for @is with @m @bs\n"),
 	  PROMPT_NONE, 0 },
 
+	/* Bad extended attribute value in inode */
+        { PR_1_INODE_EA_BAD_VALUE,
+          N_("@a in @i %i is corrupt (@n value)."),
+          PROMPT_CLEAR, 0},
+
 
 	/* Pass 1D: Reconciling multiply-claimed blocks */
 	{ PR_1D_PASS_HEADER,
e2fsck/problem.h +3 -0
Index: e2fsprogs-1.41.1/e2fsck/problem.h
===================================================================
@@ -560,6 +560,9 @@
 /* Couldn't clone file (error) */
 #define PR_1D_CLONE_ERROR	0x013008
 
+/* Bad extended attribute value in inode */
+#define PR_1_INODE_EA_BAD_VALUE		0x01006D
+
 /*
  * Pass 2 errors
  */
tests/f_bad_ea_value/expect.1 new file +11 -0
Index: e2fsprogs-1.41.1/tests/f_bad_ea_value/expect.1
===================================================================
@@ -0,0 +1,11 @@
+Pass 1: Checking inodes, blocks, and sizes
+Extended attribute in inode 13 is corrupt (invalid value).Clear? yes
+
+Pass 2: Checking directory structure
+Pass 3: Checking directory connectivity
+Pass 4: Checking reference counts
+Pass 5: Checking group summary information
+
+test_filesys: ***** FILE SYSTEM WAS MODIFIED *****
+test_filesys: 13/2048 files (0.0% non-contiguous), 1293/2048 blocks
+Exit status is 1
tests/f_bad_ea_value/expect.2 new file +7 -0
Index: e2fsprogs-1.41.1/tests/f_bad_ea_value/expect.2
===================================================================
@@ -0,0 +1,7 @@
+Pass 1: Checking inodes, blocks, and sizes
+Pass 2: Checking directory structure
+Pass 3: Checking directory connectivity
+Pass 4: Checking reference counts
+Pass 5: Checking group summary information
+test_filesys: 13/2048 files (0.0% non-contiguous), 1293/2048 blocks
+Exit status is 0
tests/f_bad_ea_value/name new file +1 -0
Index: e2fsprogs-1.41.1/tests/f_bad_ea_value/name
===================================================================
@@ -0,0 +1 @@
+invalid value of in-inode EA offset
tests/f_bad_ea_value/image.gz new file +4 -0
@@ -0,0 +1,4 @@
+��H�Iimage��|u���$� �`��,�A@������ $�ޱ��{���{k���r���}�;'���;��d�?	3����`��bRCr6�,5���ɕ�6�,�i���7�5�wI�\%�>*-)͇'^�����)��%[M�+N�M��q�_����;���>ԧ�7��k��S~���~<}��M��n�m�J�1o�ܷ���*�N3�S��6͔fN��Y�li��)���?]��0�"���M'��Oh^6q
+�+�qj7�4~��`�����5no�cl�Ƽ*b��A����4�U��4����;��wz#�����9����K�����~�uF�™J��q�����,��	�����~�����e%?��_�,�ϧK�S���w��?�3w�t�Eƽ��zmm�1�6��y�63u�q��П����������n��ƿ��f����h��ʪ����wS||�y$�3���%�e�>]V�1Zez֒�e#���wR�P[]�W�IiU��2}w�&�C��<�0�k5���gm&m�1m=`�����Ư�ܱ9k:�R�����엖9n���]��~�ܾ�'��t�f��Կ�_܆/��ɯ,�8�����K��-=�0u�q�i���4��I�����Mh^��V����9�VR�a����4����嚕��L�����?�5�3w�t�Eƽ�I��y�1�6��y�6O�_�q�NU�������_�n��Q����WV
��0<����[�#0m�������N�����5���������(����X���������?[��OL?�:��O��_|�'ۀ��ն���Zf�Z��i�4cj�ڦ���i�4k�-�n��'_�ߺ����ߧ��:�B�L�ZҲlDݘ�C�j���5)��]2C��nӤtH]��r���_69௻�_|�F�0��~e�����`��K��?��9�ߴ����Q�/C�8�_���:���k��_�������`�6�������������L�?�lB�2���_��%%s����i�4o�/�-͟
+i��.-�J�EҢi��xj�:�%Ry�:�Ω"uIK����i��5-��K˧Ҋi��rZ%uK�Ӫi��#�L��^i��;�����i��/�O��i`��I����i��a�(m�6I�����i�T����T�jҐ44
K�Ӗi�4"�L��._ٸu�Ƥ�Ԑ�Iۦ���i��c�)�vI�����i��g�+��I����ش: �J�Cҡ�tx:"��JG�cұ�t|:!��NJ'�Sҩ�tz:#���Jg�sҹ�t~� ]�.J�Kҥ�ty�"]��JW�kҵ�4.]�nH7����i|�%ݚnK��;ҝ�tw�'ݛ�K��҃��pz$=�K��'ғ��tz&=��Kϧҋ��rz%��^K��7қ��vz'���K�҇��q�$}�&������e�*}��Iߦ�������#n����$5-�#M���i��2�J��i��&�M3���,i�4[�=͑�Ls���<i�4_�[�?��]Z0-�N��E�bi��>uHK���1uJ�SE꒖LK���2�kZ6-��O+��Ji�Jꖺ�U�j�G�VO���wZ3�I}�Z�_�����4(���M���iôQ�8m�6M�����2U���:դ!ih���-�ViD�jS]��N�ӘT��6i۴]�>�vL;���.i״[�=��L{���>iߴ_��O��A��tH:4�OG�#�Q��tL:6��O'��I��tJ:5��NOg�3�Y��tN:7���O��E��tI�4]�.OW�+�U��tM�6]�ƥ��
��tS�9�O��[�m��tG�3ݕ�N��{�}���@z0=�N��G�c���Dz2=��NϤg�s���Bz1��^N��W�k���Fz3���N�w�{���A�0}�>N��Oˊ����>O_�/�W���M�6}��O?�����,5IMS�4]j�Z��S��*�N3�S��6͔fN��Y�li�4G�3͕�N�y�|�oi�TH�vi��PZ8-�M���S��!-��S��)uN�KZ2-��Nˤ�iٴ\Z>��VL+���*�[�VM���gZ=�Jk��i��'�Mk�~���NӠ�NZ7���O�
�Fi�I�4m�6O[��T���T����iX��L[�id�MuiT�:�NcR}jHۤm�vi��C�1�vN��]�ni��G�3��N��}�~il�?�L���!��tX:<��LG���1��t\:>��NL'���)��tZ:=���Lg���9��t^:?]�.L���%��tY�<]��LW���5��t]��O7��M��4>ݒnM������tW�;ݓ�M�������Pz8=�M�������Tz:=��Mϥ�����Rz9��^M�������Vz;���M������Q�8}�>M�g���E�2}��Nߤo�w���C�q�s��,5IMS�4]j�Z��S��*�N3�S��6͔fN��Y�li�4G�3͕�N�y�|�oi�TH�vi��PZ8-�M���S��!-��S��)uN�KZ2-��Nˤ�iٴ\Z>��VL+���*�[�VM���gZ=�Jk��i��'�Mk�~���NӠ�NZ7���O�
�Fi�I�4m�6O[��T���T����iX��L[�id�MuiT�:�NcR}jHۤm�vi��C�1�vN��]�ni��G�3��N��}�~il�?�L���!��tX:<��LG���1��t\:>��NL'���)��tZ:=���Lg���9��t^:?]�.L���%��tY�<]��LW���5��t]��O7��M��4>ݒnM������tW�;ݓ�M�������Pz8=�M�������Tz:=��Mϥ�����Rz9��^M�������Vz;���M������Q�8}�>M�g���E�2}��Nߤo�w���C���t|������$5M��t�yj��O-S�f��=e�͖����3�r�)�6-=t��yq;�8�{��-������u�����K�B�}atM��1���W5��Tj�kF��z�[�0��j�������Ԏ��8�:�4���2���г����k��=��ӳЮ�k��
�5�]:w^�]��_Xn�����/�v\��cE*//ި.�L��7�ÿ�Q�4�V��ԾP]W�h}aH��5����Bè����¨����j�tZmXe�К�uCs+~��������W�niN��P9Ӕs��:c�t��ʪ��3�[��e*t]���0�R�Ph_]S=|L���U
�5Յ���х�a5�^��-h�1|p����5�cj:N��N9Ϳ�k���)�������y����,���Z�fCmMy�Ν�mײ��[���A���ˢ���X���ˋ7�K!������oT�1
��%;�/T��.Z_R7zhM}����0�����0��~�1�VVY;��o���
+�p�����6�U�k}�
\ No newline at end of file