[PATCH e2fsprogs 0/2] debugfs: fix rdump path-traversal on untrusted images

debugfs "rdump" extracts a directory tree from a filesystem image to a
destination directory. It copies each raw on-disk directory entry name into
the output path without checking it, so an entry whose name contains a '/'
(for example "../escaped") in a crafted or corrupted image is written outside
the destination directory. A valid ext2/3/4 filesystem never contains such a
name, and e2fsck already flags it as corruption (PR_2_BAD_NAME), so only
untrusted or damaged images are affected, which is exactly what debugfs is
pointed at.

Patch 1 adds the guard in rdump_dirent(). Patch 2 adds a regression test,
d_rdump_safe, which fails without patch 1 (the entry escapes) and passes with
it, while still dumping the legitimate file unchanged.

The test needs a directory entry whose name contains a '/', which no standard
tool will create, so it ships a small crafted image the same way the f_* fsck
tests do; tests/d_rdump_safe/mkimage.sh documents exactly how it was built.

After applying the series the binary fixture should be intact:

  sha256sum tests/d_rdump_safe/image.gz
  e304c8fe87863da197d2565ca95599c5dca2fbd22640aefcf70258d6935eb922  (922 bytes)
  git show --stat HEAD    # patch 2 adds 5 files under tests/d_rdump_safe/

If that hash differs or files are missing, the binary block was mangled in
transit; please ask for a resend.

Happy to adjust the com_err wording or the guard's placement if you prefer.

Nexory (2):
  debugfs: reject path-traversal names in rdump
  tests: add d_rdump_safe for the debugfs rdump path-traversal guard

 debugfs/dump.c                |  10 +++++++
 tests/d_rdump_safe/expect     |   6 ++++
 tests/d_rdump_safe/image.gz   | Bin 0 -> 922 bytes
 tests/d_rdump_safe/mkimage.sh |  55 ++++++++++++++++++++++++++++++++++
 tests/d_rdump_safe/name       |   1 +
 tests/d_rdump_safe/script     |  22 ++++++++++++++
 6 files changed, 94 insertions(+)
 create mode 100644 tests/d_rdump_safe/expect
 create mode 100644 tests/d_rdump_safe/image.gz
 create mode 100755 tests/d_rdump_safe/mkimage.sh
 create mode 100644 tests/d_rdump_safe/name
 create mode 100644 tests/d_rdump_safe/script


base-commit: 43643a57fb2d3368fbacd181a8cd713102d52a1a
-- 
2.53.0