udf_get_extendedattr() had no boundary checks.
authorStian Skjelstad <stian.skjelstad@gmail.com>
Sun, 22 Aug 2021 09:33:32 +0000 (11:33 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 22 Sep 2021 09:42:59 +0000 (11:42 +0200)
commit703884a1dfb7844c3ba9899132bbab73d2e4240c
tree1c0757a83c0afd138db301b5c59504edef723005
parent8b595c4a40a90cc79dca03f320c02a833d359333
udf_get_extendedattr() had no boundary checks.

[ Upstream commit 58bc6d1be2f3b0ceecb6027dfa17513ec6aa2abb ]

When parsing the ExtendedAttr data, malicous or corrupt attribute length
could cause kernel hangs and buffer overruns in some special cases.

Link: https://lore.kernel.org/r/20210822093332.25234-1-stian.skjelstad@gmail.com
Signed-off-by: Stian Skjelstad <stian.skjelstad@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
fs/udf/misc.c