udf_get_extendedattr() had no boundary checks.
authorStian Skjelstad <stian.skjelstad@gmail.com>
Sun, 22 Aug 2021 09:33:32 +0000 (11:33 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 22 Sep 2021 09:45:18 +0000 (11:45 +0200)
commit97ab90bcbe2a4743b3744c2ec46733acba600566
tree217906dbf1621bd5606cc9b778deec9fd8310a62
parente57af4f1c921f18c4ea2e209c80f226ecddf5918
udf_get_extendedattr() had no boundary checks.

[ Upstream commit 58bc6d1be2f3b0ceecb6027dfa17513ec6aa2abb ]

When parsing the ExtendedAttr data, malicous or corrupt attribute length
could cause kernel hangs and buffer overruns in some special cases.

Link: https://lore.kernel.org/r/20210822093332.25234-1-stian.skjelstad@gmail.com
Signed-off-by: Stian Skjelstad <stian.skjelstad@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
fs/udf/misc.c