| commit | 735814f9621d63720bbd350cc5bb98b887f1158a | [log] [tgz] |
|---|---|---|
| author | Richard Weinberger <richard@nod.at> | Fri Aug 09 11:54:28 2024 +0200 |
| committer | Tom Rini <trini@konsulko.com> | Thu Aug 15 16:14:36 2024 -0600 |
| tree | e05e35550e6340b480d3596d4bcd83c469d6ad46 | |
| parent | f042f2f406e5b7d3c915c12875ee121927f667b1 [diff] |
ext4: Fix integer overflow in ext4fs_read_symlink() While zalloc() takes a size_t type, adding 1 to the le32 variable will overflow. A carefully crafted ext4 filesystem can exhibit an inode size of 0xffffffff and as consequence zalloc() will do a zero allocation. Later in the function the inode size is again used for copying data. So an attacker can overwrite memory. Avoid the overflow by using the __builtin_add_overflow() helper. Signed-off-by: Richard Weinberger <richard@nod.at>