Djam/u-boot
1
0
Fork 0
mirror of https://github.com/u-boot/u-boot.git synced 2025-04-16 09:54:35 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fs: btrfs: fix out of bounds write

Browse source 
Fix btrfs_read/read_and_truncate_page write out of bounds of destination
buffer. Old behavior break bootstd malloc'd buffers of exact file size.
Previously this OOB write have not been noticed because distroboot usually
read files into huge static memory areas.

Signed-off-by: Alex Shumsky <alexthreed@gmail.com>
Fixes: e342718 ("fs: btrfs: Implement btrfs_file_read()")
Reviewed-by: Qu Wenruo <wqu@suse.com>
This commit is contained in:
Alex Shumsky 2024-06-19 00:41:38 +03:00 • committed by Tom Rini
parent 5d9aca5e04
commit ee1941e4fe
1 changed files with 6 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
fs/btrfs/inode.c
View file

@ -640,7 +640,11 @@ static int read_and_truncate_page(struct btrfs_path *path,
extent_type = btrfs_file_extent_type(leaf, fi);
if (extent_type == BTRFS_FILE_EXTENT_INLINE) {
ret = btrfs_read_extent_inline(path, fi, buf);
memcpy(dest, buf + page_off, min(page_len, ret));
if (ret < 0) {
free(buf);
return ret;
}
memcpy(dest, buf + page_off, min3(page_len, ret, len));
free(buf);
return len;
}
@ -652,7 +656,7 @@ static int read_and_truncate_page(struct btrfs_path *path,
free(buf);
return ret;
}
memcpy(dest, buf + page_off, page_len);
memcpy(dest, buf + page_off, min(page_len, len));
free(buf);
return len;
}