[PATCH v2] ntfs: fix off-by-one page overflow in ntfs_decompress()

[PATCH v2] ntfs: fix off-by-one page overflow in ntfs_decompress()

[Dennis Tighe]

The per-token range check in ntfs_decompress() uses

	if (cb >= cb_sb_end || dp_addr > dp_sb_end)
		break;

so dp_addr == dp_sb_end falls through to the symbol copy
`*dp_addr++ = *cb++`, writing one byte past the destination page.  Since
NTFS_SB_SIZE == PAGE_SIZE the destination is a single page, so the byte
lands in the adjacent page, and *dest_ofs is left one past the sub-block
end (the later `*dest_ofs &= ~PAGE_MASK` then yields 1, not 0, so the page
is never finalized and later sub-blocks keep writing further past it).  A
corrupted compressed $DATA attribute thus produces a bounded run of
out-of-bounds writes when the file is read.

Break as soon as dp_addr reaches dp_sb_end; a full sub-block still
completes, as its final copy advances dp_addr to exactly dp_sb_end.

Fixes: 1e9ea7e04472 ("Revert "fs: Remove NTFS classic"")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Dennis Tighe <dennis.tighe@gmail.com>
Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>
---
fixing blankspace, no functional change

 fs/ntfs/compress.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ntfs/compress.c b/fs/ntfs/compress.c
index 76bd806..dc5ad95 100644
--- a/fs/ntfs/compress.c
+++ b/fs/ntfs/compress.c
@@ -352,7 +352,7 @@ static int ntfs_decompress(struct page *dest_pages[], int completed_pages[],
 		u8 *dp_back_addr;
 
 		/* Check if we are done / still in range. */
-		if (cb >= cb_sb_end || dp_addr > dp_sb_end)
+		if (cb >= cb_sb_end || dp_addr >= dp_sb_end)
 			break;
 
 		/* Determine token type and parse appropriately.*/
-- 
2.47.3

Re: [PATCH v2] ntfs: fix off-by-one page overflow in ntfs_decompress()

[Namjae Jeon]

On Thu, Aug 20, 2026 at 3:33 PM Dennis Tighe <dennis.tighe@gmail.com> wrote:
>
> The per-token range check in ntfs_decompress() uses
>
>         if (cb >= cb_sb_end || dp_addr > dp_sb_end)
>                 break;
>
> so dp_addr == dp_sb_end falls through to the symbol copy
> `*dp_addr++ = *cb++`, writing one byte past the destination page.  Since
> NTFS_SB_SIZE == PAGE_SIZE the destination is a single page, so the byte
> lands in the adjacent page, and *dest_ofs is left one past the sub-block
> end (the later `*dest_ofs &= ~PAGE_MASK` then yields 1, not 0, so the page
> is never finalized and later sub-blocks keep writing further past it).  A
> corrupted compressed $DATA attribute thus produces a bounded run of
> out-of-bounds writes when the file is read.
>
> Break as soon as dp_addr reaches dp_sb_end; a full sub-block still
> completes, as its final copy advances dp_addr to exactly dp_sb_end.
>
> Fixes: 1e9ea7e04472 ("Revert "fs: Remove NTFS classic"")
> Assisted-by: Claude:claude-opus-4-8
> Signed-off-by: Dennis Tighe <dennis.tighe@gmail.com>
> Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>
Applied it to #ntfs-next.
Thanks!