From: Paul Emge <paulemge@forallsecure.com>
Date: Mon, 8 Jul 2019 23:37:05 +0000 (-0700)
Subject: CVE-2019-13104: ext4: check for underflow in ext4fs_read_file
X-Git-Tag: v2019.10-rc1~24^2~12
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=878269dbe74229005dd7f27aca66c554e31dad8e;p=oweals%2Fu-boot.git

CVE-2019-13104: ext4: check for underflow in ext4fs_read_file

in ext4fs_read_file, it is possible for a broken/malicious file
system to cause a memcpy of a negative number of bytes, which
overflows all memory. This patch fixes the issue by checking for
a negative length.

Signed-off-by: Paul Emge <paulemge@forallsecure.com>
---

diff --git a/fs/ext4/ext4fs.c b/fs/ext4/ext4fs.c
index 85dc122f30..e2b740cac4 100644
--- a/fs/ext4/ext4fs.c
+++ b/fs/ext4/ext4fs.c
@@ -66,13 +66,15 @@ int ext4fs_read_file(struct ext2fs_node *node, loff_t pos,
 
 	ext_cache_init(&cache);
 
-	if (blocksize <= 0)
-		return -1;
-
 	/* Adjust len so it we can't read past the end of the file. */
 	if (len + pos > filesize)
 		len = (filesize - pos);
 
+	if (blocksize <= 0 || len <= 0) {
+		ext_cache_fini(&cache);
+		return -1;
+	}
+
 	blockcnt = lldiv(((len + pos) + blocksize - 1), blocksize);
 
 	for (i = lldiv(pos, blocksize); i < blockcnt; i++) {