On 19.02.25 15:18, Sascha Hauer wrote:
> The pattern malloc(size + constant) is dangerous when size can be
> manipulated by an attacker. In that case 'size' can be manipulated
> in a way that 'size + constant' is 0 due to integer overflow. The
> result is a zero sized buffer to which is then data written to.
>
> Avoid this by using size_add() instead.
For those unfamiliar with size_add(), it does a saturation addition
and thus xzalloc() will fail as it's impossible to allocate
SIZE_MAX bytes.
>
> Reported-by: Jonathan Bar Or <jonathanbaror@xxxxxxxxx>
> Signed-off-by: Sascha Hauer <s.hauer@xxxxxxxxxxxxxx>
Reviewed-by: Ahmad Fatoum <a.fatoum@xxxxxxxxxxxxxx>
Thanks,
Ahmad
> ---
> fs/cramfs/cramfs.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/fs/cramfs/cramfs.c b/fs/cramfs/cramfs.c
> index e554ebef6f..641a6d2b05 100644
> --- a/fs/cramfs/cramfs.c
> +++ b/fs/cramfs/cramfs.c
> @@ -423,7 +423,7 @@ static const char *cramfs_get_link(struct dentry *dentry, struct inode *inode)
> {
> int ret;
>
> - inode->i_link = xzalloc(inode->i_size + 1);
> + inode->i_link = xzalloc(size_add(inode->i_size, 1));
>
> ret = cramfs_read_file(inode, 0, inode->i_link, inode->i_size);
> if (ret < 0)
--
Pengutronix e.K. | |
Steuerwalder Str. 21 | http://www.pengutronix.de/ |
31137 Hildesheim, Germany | Phone: +49-5121-206917-0 |
Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
