mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-31 14:04:27 -04:00
Code Issues Packages Projects Releases Wiki Activity

ntfs: reject invalid empty mapping pairs

Browse Source 
Reject an attribute with empty mapping pairs if it has inconsistent
highest VCN and size.

Fixes: 11ccc9107d ("ntfs: update runlist handling and cluster allocator")
Reported-by: Robert Morris <rtm@csail.mit.edu>
Closes: https://lore.kernel.org/all/9519.1786907182@localhost/
Cc: stable@vger.kernel.org
Signed-off-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
This commit is contained in:
Hyunchul Lee
2026-08-20 11:18:51 +09:00
committed by Namjae Jeon
parent 9969d58a9b
commit 766062a82e
1 changed files with 19 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
fs/ntfs/runlist.c
View File

@@ -772,6 +772,25 @@ struct runlist_element *ntfs_mapping_pairs_decompress(const struct ntfs_volume *
return ERR_PTR(-EIO);
}
/*
* An empty mapping-pairs array is valid only for a zero-length
* attribute.
*/
if (!*buf &&
(vcn ||
le64_to_cpu(attr->data.non_resident.highest_vcn) !=
(u64)(vcn - 1) ||
le64_to_cpu(attr->data.non_resident.allocated_size) ||
le64_to_cpu(attr->data.non_resident.data_size) ||
le64_to_cpu(attr->data.non_resident.initialized_size))) {
ntfs_error(vol->sb, "Invalid empty mapping pairs array.");
return ERR_PTR(-EIO);
}
if (!vcn && !*buf && old_runlist && old_runlist->rl) {
*new_rl_count = old_runlist->count;
return old_runlist->rl;
}
/* Current position in runlist array. */
rlpos = 0;
/* Allocate first page and set current runlist size to one page. */