1From 878269dbe74229005dd7f27aca66c554e31dad8e Mon Sep 17 00:00:00 2001 2From: Paul Emge <paulemge@forallsecure.com> 3Date: Mon, 8 Jul 2019 16:37:05 -0700 4Subject: [PATCH] CVE-2019-13104: ext4: check for underflow in ext4fs_read_file 5 6in ext4fs_read_file, it is possible for a broken/malicious file 7system to cause a memcpy of a negative number of bytes, which 8overflows all memory. This patch fixes the issue by checking for 9a negative length. 10 11Signed-off-by: Paul Emge <paulemge@forallsecure.com> 12--- 13 fs/ext4/ext4fs.c | 8 +++++--- 14 1 file changed, 5 insertions(+), 3 deletions(-) 15 16diff --git a/fs/ext4/ext4fs.c b/fs/ext4/ext4fs.c 17index 85dc122..e2b740c 100644 18--- a/fs/ext4/ext4fs.c 19+++ b/fs/ext4/ext4fs.c 20@@ -66,13 +66,15 @@ int ext4fs_read_file(struct ext2fs_node *node, loff_t pos, 21 22 ext_cache_init(&cache); 23 24- if (blocksize <= 0) 25- return -1; 26- 27 /* Adjust len so it we can't read past the end of the file. */ 28 if (len + pos > filesize) 29 len = (filesize - pos); 30 31+ if (blocksize <= 0 || len <= 0) { 32+ ext_cache_fini(&cache); 33+ return -1; 34+ } 35+ 36 blockcnt = lldiv(((len + pos) + blocksize - 1), blocksize); 37 38 for (i = lldiv(pos, blocksize); i < blockcnt; i++) { 39-- 401.9.1 41 42