[PATCH 0/2] volume_id/ntfs: fix out-of-bounds reads and an infinite loop

The NTFS volume_id prober walks the $Volume MFT record using offsets
read directly from the image without checking that they stay within
the record. A crafted NTFS image can reach this code through normal
blkid/lsblk probing or through udev auto-probing a removable device, so
the input is untrusted.

1/2 adds bounds checks for the attribute header and volume-label read.
This fixes two out-of-bounds reads, one of which can expose adjacent
heap memory as the volume label.

2/2 prevents the attribute walk from looping forever when attr_off
wraps around due to a malicious attribute length.

Both were reproduced on crafted images (1/2 under AddressSanitizer, 2/2
by the hang disappearing); I can send the images if useful.

Ali Ahmet Memis (2):
  volume_id/ntfs: bound attribute and label reads to the MFT record
  volume_id/ntfs: stop the attribute walk from looping forever

 util-linux/volume_id/ntfs.c | 31 ++++++++++++++++++++++++-------
 1 file changed, 24 insertions(+), 7 deletions(-)

-- 
2.55.0