[PATCH 2/2] volume_id/ntfs: stop the attribute walk from looping forever

The attribute walk advances attr_off by attr->len, where the length
comes directly from the filesystem image. A crafted record can provide
a large enough value to make the unsigned attr_off wrap around. If it
wraps to an offset that is still inside the record, the walk can
revisit the same offsets and never terminate.

This can hang the prober when a crafted filesystem image is processed
through blkid/lsblk or automatically probed by udev.

Reject an attribute whose length extends beyond the remaining part of
the record. This prevents the wraparound and ensures that the attribute
walk cannot continue past the record boundary.

The issue was reproduced with a crafted image: blkid hangs before this
change and terminates normally afterwards.

              text    data     bss     dec     hex filename
   before      329       0       0     329     149 util-linux/volume_id/ntfs.o
   after       353       0       0     353     161 util-linux/volume_id/ntfs.o
                                       +24

Signed-off-by: Ali Ahmet Memis <[email protected]>
---
 util-linux/volume_id/ntfs.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/util-linux/volume_id/ntfs.c b/util-linux/volume_id/ntfs.c
index 19055e7db..c9b8a1e46 100644
--- a/util-linux/volume_id/ntfs.c
+++ b/util-linux/volume_id/ntfs.c
@@ -201,6 +201,11 @@ int FAST_FUNC volume_id_probe_ntfs(struct volume_id *id /*,uint64_t off*/)
 			}
 		}
 
+		/* An attribute must fit in the record. This also keeps
+		 * attr_off from wrapping around and looping forever.
+		 */
+		if (attr_len > mft_record_size - attr_off)
+			break;
 		attr_off += attr_len;
 	}
 
-- 
2.55.0