[PATCH] ntfs3: Add a check for attr_names and oatbl

[lei lu <llfamsec@xxxxxxxxx>]

This patch fixes two issues. First, if ane->off is a large offset,
it will trigger out-of-bound write on oe. Second, if ane->name_bytes
is too large, it will trigger out-of-bound read on the next ane. We
also should add a check before visiting the fixed members of ane and oe.

Signed-off-by: lei lu <llfamsec@xxxxxxxxx>
---
 fs/ntfs3/fslog.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c
index 855519713bf7..5f7c8bdbb69a 100644
--- a/fs/ntfs3/fslog.c
+++ b/fs/ntfs3/fslog.c
@@ -3740,6 +3740,7 @@ int log_replay(struct ntfs_inode *ni, bool *initialized)
 	u32 i, bytes_per_attr_entry;
 	u32 vbo, tail, off, dlen;
 	u32 saved_len, rec_len, transact_id;
+	u32 attr_names_len, oatbl_len;
 	bool use_second_page;
 	struct RESTART_AREA *ra2, *ra = NULL;
 	struct CLIENT_REC *ca, *cr;
@@ -4246,6 +4247,7 @@ int log_replay(struct ntfs_inode *ni, bool *initialized)
 		err = -ENOMEM;
 		goto out;
 	}
+	attr_names_len = rec_len;
 
 	lcb_put(lcb);
 	lcb = NULL;
@@ -4285,6 +4287,7 @@ int log_replay(struct ntfs_inode *ni, bool *initialized)
 		err = -ENOMEM;
 		goto out;
 	}
+	oatbl_len = t32;
 
 	log->open_attr_tbl = oatbl;
 
@@ -4315,15 +4318,30 @@ int log_replay(struct ntfs_inode *ni, bool *initialized)
 check_attribute_names2:
 	if (rst->attr_names_len && oatbl) {
 		struct ATTR_NAME_ENTRY *ane = attr_names;
+		struct ATTR_NAME_ENTRY *attr_names_end =
+			(struct ATTR_NAME_ENTRY *)Add2Ptr(attr_names, attr_name_len);
+		struct OPEN_ATTR_ENTRY *oatbl_end =
+			(struct OPEN_ATTR_ENTRY *)Add2Ptr(oatbl, oatbl_len);
 		while (ane->off) {
 			/* TODO: Clear table on exit! */
 			oe = Add2Ptr(oatbl, le16_to_cpu(ane->off));
+			if (oe + 1 > oatbl_end) {
+				err = -EINVAL;
+				goto out;
+			}
+
 			t16 = le16_to_cpu(ane->name_bytes);
 			oe->name_len = t16 / sizeof(short);
 			oe->ptr = ane->name;
 			oe->is_attr_name = 2;
+
 			ane = Add2Ptr(ane,
 				      sizeof(struct ATTR_NAME_ENTRY) + t16);
+			if (ane > attr_names_end ||
+			    ane + 1 > attr_names_end) {
+				err = -EINVAL;
+				goto out;
+			}
 		}
 	}
 
-- 
2.34.1