[Bug 254964] Integer overflow in ffs_setextattr() could lead to a kernel heap overflow

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=254964

Mark Johnston <markj at FreeBSD.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |markj at FreeBSD.org

--- Comment #1 from Mark Johnston <markj at FreeBSD.org> ---
The attribute name length is checked by callers of the VOP, or is not
user-controlled to begin with.  Callers of extattr_set_vp(), for example, will
provide a string of length at most EXTATTR_MAXNAMELEN == NAME_MAX.  We should
perhaps assert this limit in ffs_setextattr().

ip->i_ea_len is not directly user-controlled, it is the size of the extattrs
for the inode represented by ip.  The space reserved for extattrs is limited to
two blocks and ffs_setextattr() checks this.

I may well be missing something - do you have a test case to demonstrate the
problem?

-- 
You are receiving this mail because:
You are the assignee for the bug.