ext4: check for NUL characters in extended attribute's name

Extended attribute names are defined to be NUL-terminated, so the name must not contain a NUL character. This is important because there are places when remove extended attribute, the code uses strlen to determine the length of the entry. That should probably be fixed at some point, but code is currently really messy, so the simplest fix for now is to simply validate that the extended attributes are sane. https://bugzilla.kernel.org/show_bug.cgi?id=200401 Reported-by: Wen Xu <[email protected]> Signed-off-by: Theodore Ts'o <[email protected]> Cc: [email protected]
natale-p · Aug 1, 2018 · 7d95178 · 7d95178
1 parent 5ef2a69
commit 7d95178
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
@@ -190,6 +190,8 @@ ext4_xattr_check_entries(struct ext4_xattr_entry *entry, void *end,
 		struct ext4_xattr_entry *next = EXT4_XATTR_NEXT(e);
 		if ((void *)next >= end)
 			return -EFSCORRUPTED;
+		if (strnlen(e->e_name, e->e_name_len) != e->e_name_len)
+			return -EFSCORRUPTED;
 		e = next;
 	}