ntfs: fix off-by-one page overflow in ntfs_decompress()

Browse source

The per-token range check in ntfs_decompress() uses

	if (cb >= cb_sb_end || dp_addr > dp_sb_end)
		break;

so dp_addr == dp_sb_end falls through to the symbol copy
`*dp_addr++ = *cb++`, writing one byte past the destination page.  Since
NTFS_SB_SIZE == PAGE_SIZE the destination is a single page, so the byte
lands in the adjacent page, and *dest_ofs is left one past the sub-block
end (the later `*dest_ofs &= ~PAGE_MASK` then yields 1, not 0, so the page
is never finalized and later sub-blocks keep writing further past it).  A
corrupted compressed $DATA attribute thus produces a bounded run of
out-of-bounds writes when the file is read.

Break as soon as dp_addr reaches dp_sb_end; a full sub-block still
completes, as its final copy advances dp_addr to exactly dp_sb_end.

Fixes: 1e9ea7e044 ("Revert "fs: Remove NTFS classic"")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Dennis Tighe <dennis.tighe@gmail.com>
Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>

...

This commit is contained in:

Dennis Tighe 2026-08-19 23:32:58 -07:00 • committed by Namjae Jeon

parent 60038154b4

commit 98716c9fce

1 changed files with 1 additions and 1 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

2

fs/ntfs/compress.c

View file