[18528] in bugtraq
Re: major security bug in reiserfs (may affect SuSE Linux)
daemon@ATHENA.MIT.EDU (Marc Lehmann)
Wed Jan 10 14:22:20 2001
Mail-Followup-To: bugtraq@securityfocus.com
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Message-Id: <20010110032727.A973@cerebro.laendle>
Date: Wed, 10 Jan 2001 03:27:27 +0100
Reply-To: Marc Lehmann <pcg@GOOF.COM>
From: Marc Lehmann <pcg@GOOF.COM>
To: BUGTRAQ@SECURITYFOCUS.COM
The bug seems to be confirmed. The patch below does not fix it, it,
however, limits the filename length to a maximum of 255 chars. This might,
of course, make some file inaccessbile but at least one shouldn't be able
to crash the machine or worse, this the forward to bugtraq.
----- Forwarded message from Chris Mason <mason@suse.com> -----
Subject: Re: [reiserfs-list] major security bug in reiserfs (may affect SuSE Linux)
From: Chris Mason <mason@suse.com>
Date: Tue, 09 Jan 2001 21:23:44 -0500
To: Marc Lehmann <pcg@goof.com>
cc: reiserfs-list@namesys.com, linux-kernel@vger.kernel.org,
vs@namesys.botik.ru
X-Mailer: Mulberry/2.0.6b1 (Linux/x86)
On Wednesday, January 10, 2001 02:32:09 AM +0100 Marc Lehmann <pcg@goof.com> wrote:
>>> EIP; c013f911 <filldir+20b/221> <=====
> Trace; c013f706 <filldir+0/221>
> Trace; c0136e01 <reiserfs_getblk+2a/16d>
The buffer reiserfs is sending to filldir is big enough for
the huge file name, so I think the real fix should be done in VFSland.
But, in the interest of providing a quick, obviously correct fix, this
reiserfs only patch will refuse to create file names larger
than 255 chars, and skip over any directory entries larger than
255 chars.
--- linux/include/linux/reiserfs_fs.h.1 Tue Jan 9 21:56:18 2001
+++ linux/include/linux/reiserfs_fs.h Tue Jan 9 21:56:33 2001
@@ -467,7 +467,7 @@
/* name by bh, ih and entry_num */
#define B_I_E_NAME(entry_num,bh,ih) ((char *)(bh->b_data + ih->ih_item_location + (B_I_DEH(bh,ih)+(entry_num))->deh_location))
-#define REISERFS_MAX_NAME_LEN(block_size) (block_size - BLKH_SIZE - IH_SIZE - DEH_SIZE) /* -SD_SIZE when entry will contain stat data */
+#define REISERFS_MAX_NAME_LEN(block_size) 255
/* this structure is used for operations on directory entries. It is not a disk structure. */
/* When reiserfs_find_entry or search_by_entry_key find directory entry, they return filled reiserfs_dir_entry structure */
--- linux/fs/reiserfs/dir.c.1 Tue Jan 9 22:06:06 2001
+++ linux/fs/reiserfs/dir.c Tue Jan 9 22:15:17 2001
@@ -159,6 +159,10 @@
d_name = B_I_DEH_ENTRY_FILE_NAME (bh, ih, deh);
d_off = deh->deh_offset;
d_ino = deh->deh_objectid;
+ if (d_reclen > REISERFS_MAX_NAME_LEN(inode->i_sb->s_blocksize)){
+ /* it is too big to send back to VFS */
+ continue ;
+ }
if (d_reclen <= 32) {
local_buf = small_buf ;
} else {
----- End forwarded message -----
--
-----==- |
----==-- _ |
---==---(_)__ __ ____ __ Marc Lehmann +--
--==---/ / _ \/ // /\ \/ / pcg@opengroup.org |e|
-=====/_/_//_/\_,_/ /_/\_\ XX11-RIPE --+
The choice of a GNU generation |
|
