fs/ntfs3: Validate ff offset

This adds sanity checks for ff offset. There is a check
on rt->first_free at first, but walking through by ff
without any check. If the second ff is a large offset.
We may encounter an out-of-bound read.

Signed-off-by: lei lu <llfamsec@gmail.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>

diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c
index 763644f90094bb64c72ee493db4e84fff48382be..6c18dc6c4cec3f81a334a3ef73bbaf576fc5cb31 100644 (file)
--- a/fs/ntfs3/fslog.c
+++ b/fs/ntfs3/fslog.c
@@ -724,7 +724,8 @@ static bool check_rstbl(const struct RESTART_TABLE *rt, size_t bytes)
 
        if (!rsize || rsize > bytes ||
            rsize + sizeof(struct RESTART_TABLE) > bytes || bytes < ts ||
-           le16_to_cpu(rt->total) > ne || ff > ts || lf > ts ||
+           le16_to_cpu(rt->total) > ne ||
+                       ff > ts - sizeof(__le32) || lf > ts - sizeof(__le32) ||
            (ff && ff < sizeof(struct RESTART_TABLE)) ||
            (lf && lf < sizeof(struct RESTART_TABLE))) {
                return false;
@@ -754,6 +755,9 @@ static bool check_rstbl(const struct RESTART_TABLE *rt, size_t bytes)
                        return false;
 
                off = le32_to_cpu(*(__le32 *)Add2Ptr(rt, off));
+
+               if (off > ts - sizeof(__le32))
+                       return false;
        }
 
        return true;