[Bug 299430] ext2fs: fix out-of-bounds write in ext4_ext_find_extent() for maximum-depth (5) extent trees

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=299430

            Bug ID: 299430
           Summary: ext2fs: fix out-of-bounds write in
                    ext4_ext_find_extent() for maximum-depth (5) extent
                    trees
           Product: Base System
           Version: Unspecified
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Many People
          Priority: ---
         Component: kern
          Assignee: bugs@FreeBSD.org
          Reporter: david@crap.solutions

Created attachment 275747
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=275747&action=edit
fix out-of-bounds write in ext4_ext_find_extent()

ext4_ext_find_extent() allocates EXT4_EXT_DEPTH_MAX (5) struct ext4_extent_path
entries, but
the tree walk stores path[0] through path[depth], inclusive. A filesystem whose
inode extent
header has eh_depth == EXT4_EXT_DEPTH_MAX therefore writes path[5], one entry
past the
allocation.

eh_depth 5 is a valid on-disk value (the maximum extent depth, reached by large
files grown
over time); Linux's EXT4_MAX_EXTENT_DEPTH is likewise 5 and ext4_find_extent()
rejects only
depths greater than that.

Reproduce: Mount an ext4 filesystem crafted with an inode whose extent header
has eh_depth
5. Reproduced on 16-CURRENT in a bhyve guest: MemGuard guard-page fault in
ext4_ext_find_extent().

-- 
You are receiving this mail because:
You are the assignee for the bug.