Out-of-bounds access (OVERRUN) in filesystems/fsw_ext4.c >> fsw_ext4_readlink

[dakanji]

Memory Corruption from Out-of-Bounds Access

Checking dno->g.size > 4096ULL (implies that dno->g.size may be up to 4096 on the false branch) in:

RefindPlus/filesystems/fsw_ext4.c

Line 726 in c9e64c9

if (dno->g.size > FSW_PATH_MAX)

Assigning: s.len = (int)dno->g.size (The value of s.len may now be up to 4096) in:

RefindPlus/filesystems/fsw_ext4.c

Line 735 in c9e64c9

s.size = s.len = (int)dno->g.size;

Assigning: s.data = dno->raw->i_block.
s.data now points to byte 0 of dno->raw->i_block (which consists of 60 bytes) in:

RefindPlus/filesystems/fsw_ext4.c

Line 736 in c9e64c9

s.data = dno->raw->i_block;

Overrunning buffer pointed to by s.data of 60 bytes by passing it to a function which accesses it at byte offset 4095 using argument s.len (which evaluates to 4096) in:

RefindPlus/filesystems/fsw_ext4.c

Line 737 in c9e64c9

status = fsw_strdup_coerce(link_target, vol->g.host_string_type, &s);

[joevt]

I guess there needs to be a check to make sure the symlink size is not greater than 60 bytes when it is inlined.

So after this line:

RefindPlus/filesystems/fsw_ext4.c

Line 732 in 111e798

if (dno->raw->i_blocks_lo - ea_blocks == 0) {

Add this:

    if (dno->g.size > sizeof(dno->raw->i_block))
        return FSW_VOLUME_CORRUPTED;

[dakanji]

Makes sense