Re: [PATCH] ntfs: verify run length exceeding volume boundary
Namjae Jeon <[email protected]>
| Newsgroups | dev.linux.lists.ntfs,org.kernel.vger.linux-kernel,org.kernel.vger.stable |
|---|---|
| Message-ID | <CAKYAXd9KtNhc7x8N0RaaAY-D5CJbanCB6Cy5_FgaTAKFvzcAwQ@mail.gmail.com> |
On Tue, Aug 11, 2026 at 11:15 AM Hongling Zeng <[email protected]> wrote: > > The mapping pairs decoder validates that the starting LCN is within the > volume but does not check if the run extends beyond the volume boundary. > > A malformed NTFS image with a crafted mapping pairs array could cause > the kernel to access memory beyond the volume boundary, potentially leading > to memory corruption and privilege escalation. > > Add validation to ensure lcn + length stays within nr_clusters. > > Cc: [email protected] > Fixes: b4be3a47f8ba4 ("ntfs: bound the free-cluster bitmap scan to the volume") > Signed-off-by: Hongling Zeng <[email protected]> Applied it to #ntfs-next. Thanks!