[PATCH] fs/adfs: bound F+ directory entry name length

[PATCH] fs/adfs: bound F+ directory entry name length

[Marouane El Moufid]

adfs_fplus_getnext() reads the entry name length (bigdirobnamelen, u32)
from disk and passes it to adfs_dir_copyfrom() as the length to copy into
the fixed 260-byte on-stack obj->name buffer. adfs_dir_copyfrom() bounds
only the source, so a crafted F+ directory entry overflows the stack
(KASAN: stack-out-of-bounds, write; stack-protector panic), reachable
from a mounted crafted ADFS image by a readdir (ls).

Reject an entry whose name does not fit in obj->name, leaving room for
the optional ",xyz" filetype suffix appended by adfs_object_fixup().

Signed-off-by: Marouane El Moufid <eun0us@espilon.net>
---
 fs/adfs/dir_fplus.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/adfs/dir_fplus.c b/fs/adfs/dir_fplus.c
--- a/fs/adfs/dir_fplus.c
+++ b/fs/adfs/dir_fplus.c
@@ -192,6 +192,8 @@
 	obj->indaddr  = le32_to_cpu(bde.bigdirindaddr);
 	obj->attr     = le32_to_cpu(bde.bigdirattr);
 	obj->name_len = le32_to_cpu(bde.bigdirobnamelen);
+	if (obj->name_len > ADFS_MAX_NAME_LEN - 4)
+		return -EINVAL;

 	offset = adfs_fplus_offset(h, le32_to_cpu(h->bigdirentries));
 	offset += le32_to_cpu(bde.bigdirobnameptr);