|
| 1 | +From 717cff571371fcc07b04641fd0d6dc54c9cefdb9 Mon Sep 17 00:00:00 2001 |
| 2 | +From: Erik Larsson <erik@tuxera.com> |
| 3 | +Date: Tue, 24 Feb 2026 10:04:31 +0200 |
| 4 | +Subject: [PATCH] acls.c: Fix heap buffer overflow in |
| 5 | + 'ntfs_build_permissions_posix'. |
| 6 | + |
| 7 | +The root cause was that the memory allocated for the ACE entries was |
| 8 | +insufficient for the worst case scenario when group entries were added |
| 9 | +for mask entries that didn't have a corresponding group entry already. |
| 10 | +Fixed by allocating space for the worst case number of ACE entries. |
| 11 | + |
| 12 | +This was reported by Andrea Bocchetti with a thorough report which made |
| 13 | +it very easy to fix. |
| 14 | + |
| 15 | +This is a backport of the original patch to version 2022.10.3. |
| 16 | +--- |
| 17 | + libntfs-3g/acls.c | 25 ++++++++++++++++++++----- |
| 18 | + 1 file changed, 20 insertions(+), 5 deletions(-) |
| 19 | + |
| 20 | +diff --git a/libntfs-3g/acls.c b/libntfs-3g/acls.c |
| 21 | +index 9f16fec..4cf534b 100644 |
| 22 | +--- a/libntfs-3g/acls.c |
| 23 | ++++ b/libntfs-3g/acls.c |
| 24 | +@@ -3716,12 +3716,27 @@ struct POSIX_SECURITY *ntfs_build_permissions_posix( |
| 25 | + /* |
| 26 | + * Build a raw posix security descriptor |
| 27 | + * by just translating permissions and ids |
| 28 | +- * Add 2 to the count of ACE to be able to insert |
| 29 | +- * a group ACE later in access and default ACLs |
| 30 | +- * and add 2 more to be able to insert ACEs for owner |
| 31 | +- * and 2 more for other |
| 32 | ++ * |
| 33 | ++ * The worst case number of ACE entries consists of: |
| 34 | ++ * - 'acecount' ACE entries from the main loop (see below) |
| 35 | ++ * iterating over the 'securattr' array. |
| 36 | ++ * - 1 ACE entry which may be added when creating world |
| 37 | ++ * permissions if none exist. |
| 38 | ++ * - 1 ACE entry which may be added when setting basic owner |
| 39 | ++ * permissions if none exist (both lists). |
| 40 | ++ * - 1 ACE entry which may be added when duplicating world |
| 41 | ++ * permissions as group_obj permissions if none exist. |
| 42 | ++ * - 'acecount + 2' ACE entries which may be added when |
| 43 | ++ * duplicating world permissions as group permissions if they |
| 44 | ++ * were converted to masks and the masks are not followed by a |
| 45 | ++ * group entry. |
| 46 | ++ * - 1 ACE entry which may be added when inserting a default |
| 47 | ++ * mask if none is present and there are designated users or |
| 48 | ++ * groups. |
| 49 | ++ * |
| 50 | ++ * This amounts to 2*acecnt + 6 ACE entries in the worst case. |
| 51 | + */ |
| 52 | +- alloccnt = acecnt + 6; |
| 53 | ++ alloccnt = 2*acecnt + 6; |
| 54 | + pxdesc = (struct POSIX_SECURITY*)malloc( |
| 55 | + sizeof(struct POSIX_SECURITY) |
| 56 | + + alloccnt*sizeof(struct POSIX_ACE)); |
| 57 | +-- |
| 58 | +2.45.4 |
| 59 | + |
0 commit comments