ntfs: reject index blocks with a too small entries offset

Index blocks read from the volume are checked for a plausible header, but
nothing keeps a block from placing its entries closer to the header than
ntfs_ib_alloc() does when it creates one.  The allocation adds the update
sequence array, one entry per 512-byte sector plus the terminator, to the
index header and aligns the result to 8 bytes, so the first entry of a
4096-byte block starts at offset 40, while a corrupt block may declare 16.

ntfs_ib_copy_tail() then copies the entries that follow the median entry
from the source block into a freshly allocated destination.  The tail is
sized as index_length minus entries_offset and the median entry, both from
the source, while the destination only has allocated_size minus the
canonical offset of room.  With the values above the tail is 4040 bytes
and the destination holds 4032, so the last 8 bytes are written past the
end of the new allocation, with contents taken from the mounted image.

Reject such a block when it is read: entries_offset must not be smaller
than the canonical offset for the block size.  Derive it from block_size
rather than from the block's own usa_count, which post_read_mst_fixup()
treats as "not protected" when it does not match the block size, and use
the same helper in ntfs_ib_alloc() so both stay in sync.

Fixes: 0a8ac0c1fa0b ("ntfs: update directory operations")
Signed-off-by: Hang Nan <2122295973@qq.com>
Reviewed-by: Baolin Liu <liubaolin@kylinos.cn>
Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>

0 files changed, 0 insertions, 0 deletions