ntfs: don't allow resident values to overlap the attribute header

The resident value bounds check allows value_offset to point inside the
attribute header. The reported image has an unnamed $DATA attribute with
a value_offset of zero and a value_length of two, which passes lookup.

Appending to this file makes ntfs_resident_attr_value_resize() shrink the
attribute record to eight bytes. Moving the following attributes then
overwrites the resident header fields, so the subsequent memset() uses a
corrupted value_offset and writes outside the MFT record buffer.

Require the resident value to start after the complete resident header.
Both lookup paths then return -EIO for the corrupt record, before callers
can resize or access its value.

Fixes: 495e90fa3348 ("ntfs: update attrib operations")
Reported-by: Robert Morris <rtm@mit.edu>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>

0 files changed, 0 insertions, 0 deletions