aboutsummaryrefslogtreecommitdiffstats
path: root/main/e2fsprogs/CVE-2019-5188.patch
blob: d60b118ac324a59e3e85365e1910bdd8b374668c (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
diff --git a/e2fsck/pass1b.c b/e2fsck/pass1b.c
index 5693b9c..bca701c 100644
--- a/e2fsck/pass1b.c
+++ b/e2fsck/pass1b.c
@@ -705,6 +705,10 @@ static void delete_file(e2fsck_t ctx, ext2_ino_t ino,
 		fix_problem(ctx, PR_1B_BLOCK_ITERATE, &pctx);
 	if (ctx->inode_bad_map)
 		ext2fs_unmark_inode_bitmap2(ctx->inode_bad_map, ino);
+	if (ctx->inode_reg_map)
+		ext2fs_unmark_inode_bitmap2(ctx->inode_reg_map, ino);
+	ext2fs_unmark_inode_bitmap2(ctx->inode_dir_map, ino);
+	ext2fs_unmark_inode_bitmap2(ctx->inode_used_map, ino);
 	ext2fs_inode_alloc_stats2(fs, ino, -1, LINUX_S_ISDIR(dp->inode.i_mode));
 	quota_data_sub(ctx->qctx, &dp->inode, ino,
 		       pb.dup_blocks * fs->blocksize);
diff --git a/e2fsck/rehash.c b/e2fsck/rehash.c
index a5fc1be..2c908be 100644
--- a/e2fsck/rehash.c
+++ b/e2fsck/rehash.c
@@ -160,6 +160,10 @@ static int fill_dir_block(ext2_filsys fs,
 		dir_offset += rec_len;
 		if (dirent->inode == 0)
 			continue;
+		if ((name_len) == 0) {
+			fd->err = EXT2_ET_DIR_CORRUPTED;
+			return BLOCK_ABORT;
+		}
 		if (!fd->compress && (name_len == 1) &&
 		    (dirent->name[0] == '.'))
 			continue;
@@ -401,6 +405,11 @@ static int duplicate_search_and_fix(e2fsck_t ctx, ext2_filsys fs,
 			continue;
 		}
 		new_len = ext2fs_dirent_name_len(ent->dir);
+		if (new_len == 0) {
+			 /* should never happen */
+			ext2fs_unmark_valid(fs);
+			continue;
+		}
 		memcpy(new_name, ent->dir->name, new_len);
 		mutate_name(new_name, &new_len);
 		for (j=0; j < fd->num_array; j++) {
@@ -1019,6 +1028,8 @@ void e2fsck_rehash_directories(e2fsck_t ctx)
 			if (!ext2fs_u32_list_iterate(iter, &ino))
 				break;
 		}
+		if (!ext2fs_test_inode_bitmap2(ctx->inode_dir_map, ino))
+			continue;
 
 		pctx.dir = ino;
 		if (first) {