Skip to contentSkip to conversation

fsck.f2fs: do not hard-code encrypted filename length to avoid heap buffer overflow

PATCH In review Jaegeuk Kim 2 participants 3 messages Oct 10, 2018 – Oct 15, 2018

lore
Share & tools
lore

Jaegeuk Kim

author
#0 lore raw

PATCH 1/1 fsck.f2fs: do not hard-code encrypted filename length to avoid heap buffer overflow

From: Randall Huang <[email protected]>

If the len is less than 24, heap buffer overflow is reported.

Signed-off-by Randall Huang <[email protected]>
Signed-off-by Jaegeuk Kim <[email protected]>
---
 fsck/fsck.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)
fsck/fsck.c +3 -1
index 85d9823..1fc168f 100644
@@ -1170,10 +1170,12 @@ int convert_encrypted_name(unsigned char *name, u32 len,
 		memcpy(new, name, len);
 		new[len] = 0;
 		return len;
+	} else if (len != 24) {
+		ASSERT_MSG("len: %d, encrypted name must be 24\n", len);
 	}
 
 	*new = '_';
-	return digest_encode((const char *)name, 24, (char *)new + 1);
+	return digest_encode((const char *)name, len, (char *)new + 1);
 }
 
 static void print_dentry(__u32 depth, __u8 *name,
Signature · 1 line
2.19.0.605.g01d371f741-goog
author
#2 lore raw
Quoted 11 lines · Chao Yu
Quoted 6 lines · Jaegeuk Kim

From: Randall Huang <[email protected]>

If the len is less than 24, heap buffer overflow is reported.

Signed-off-by Randall Huang <[email protected]>
Signed-off-by Jaegeuk Kim <[email protected]>
Reviewed-by Chao Yu <[email protected]>

Thanks,

The correct one should be this.

Quoted 1 line

From e78b033dea8ec556b9b4c216426150317a8e5640 Mon Sep 17 00:00:00 2001

From: Randall Huang <[email protected]>
Date: Tue, 9 Oct 2018 17:38:01 -0700
Subject: [PATCH] fsck.f2fs: do not hard-code encrypted filename length to
avoid heap buffer overflow

If the len is less than 24, heap buffer overflow is reported.

Signed-off-by Randall Huang <[email protected]>
Signed-off-by Jaegeuk Kim <[email protected]>
---
 fsck/fsck.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
fsck/fsck.c +2 -2
index 85d9823..366ba13 100644
@@ -1145,7 +1145,7 @@ static int digest_encode(const char *src, int len, char *dst)
 	int i = 0, bits = 0, ac = 0;
 	char *cp = dst;
 
-	while (i < len) {
+	while (i < len && i < 24) {
 		ac += (((unsigned char) src[i]) << bits);
 		bits += 8;
 		do {

@@ -1173,7 +1173,7 @@ int convert_encrypted_name(unsigned char *name, u32 len,
 	}
 
 	*new = '_';
-	return digest_encode((const char *)name, 24, (char *)new + 1);
+	return digest_encode((const char *)name, len, (char *)new + 1);
 }
 
 static void print_dentry(__u32 depth, __u8 *name,
Signature · 1 line
2.19.0.605.g01d371f741-goog