Re: [PATCH 1/3] resize2fs: out-of-bounds read/write in xattr entry scanning

On Jul 30, 2026, at 21:36, Josh Hunt <[email protected]> wrote:
>=20
> From: Kit Knox <[email protected]>
>=20
> The fix_ea_entries() function iterates over extended attribute entries
> using the loop condition "while (entry < end && =
!EXT2_EXT_IS_LAST_ENTRY(entry))".
> This check is insufficient because:
>=20
>  1. It does not verify the full 16-byte ext2_ext_attr_entry structure =
fits
>     within the buffer before accessing its fields. With fewer than 16 =
bytes
>     remaining, evaluating EXT2_EXT_IS_LAST_ENTRY() reads past the =
buffer.
>=20
>  2. A crafted e_name_len value can cause EXT2_EXT_ATTR_NEXT() to =
advance
>     past the buffer boundary, and subsequent iterations read/write =
beyond
>     allocated memory.
>=20
>  3. When entry->e_value_inum > last_ino, resize2fs writes to =
entry->e_value_inum,
>     potentially corrupting heap memory.
>=20
> Additionally, fix_ea_ibody_entries() does not validate i_extra_isize =
before
> using it to compute xattr offsets. A malformed inode with an invalid
> i_extra_isize value (unaligned or too large) causes out-of-bounds =
reads
> when accessing the ea_magic field.
>=20
> Signed-off-by: Kit Knox <[email protected]>
> ---
> resize/resize2fs.c | 21 ++++++++++++++++++++-
> 1 file changed, 20 insertions(+), 1 deletion(-)

This seems reasonable.

Reviewed-by: Andreas Dilger <[email protected] =
<mailto:[email protected]>>

Cheers, Andreas