ec1bedd797
[ Upstream commit b2dd7b953c25ffd5912dda17e980e7168bebcf6c ]
The issue here is when this is called from ntfs_load_attr_list(). The
"size" comes from le32_to_cpu(attr->res.data_size) so it can't overflow
on a 64bit systems but on 32bit systems the "+ 1023" can overflow and
the result is zero. This means that the kmalloc will succeed by
returning the ZERO_SIZE_PTR and then the memcpy() will crash with an
Oops on the next line.
Fixes:
|
||
|---|---|---|
| .. | ||
| lib | ||
| Kconfig | ||
| Makefile | ||
| attrib.c | ||
| attrlist.c | ||
| bitfunc.c | ||
| bitmap.c | ||
| debug.h | ||
| dir.c | ||
| file.c | ||
| frecord.c | ||
| fslog.c | ||
| fsntfs.c | ||
| index.c | ||
| inode.c | ||
| lznt.c | ||
| namei.c | ||
| ntfs.h | ||
| ntfs_fs.h | ||
| record.c | ||
| run.c | ||
| super.c | ||
| upcase.c | ||
| xattr.c | ||