diff options
| author | Samuel Moelius <sam.moelius@trailofbits.com> | 2026-06-03 20:41:09 +0300 |
|---|---|---|
| committer | Namjae Jeon <linkinjeon@kernel.org> | 2026-06-05 18:20:26 +0300 |
| commit | ec4f061f2219e0f0c6465d56d0380bf749235a53 (patch) | |
| tree | c5633cdb6a6932b64e8ed446c68f19c033a15a4c /include/linux/timerqueue.h | |
| parent | 38e8db370843b518ff9bee4af46c6b800684cc78 (diff) | |
| download | linux-ec4f061f2219e0f0c6465d56d0380bf749235a53.tar.xz | |
ntfs: detect mapping-pairs LCN accumulator overflow
The NTFS mapping-pairs parser accumulates relative LCN deltas in a
signed integer. A corrupted attribute can drive that addition past
the representable range.
One corrupt runlist shape sets the accumulated LCN to S64_MAX and
then adds a delta of 1 in the next mapping-pairs entry.
Signed overflow is undefined and can turn an invalid runlist into a
different set of physical clusters.
Check the LCN addition for overflow before storing the next run.
Cc: stable@vger.kernel.org # v7.1
Assisted-by: Codex:gpt-5.5-cyber-preview
Signed-off-by: Samuel Moelius <sam.moelius@trailofbits.com>
Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Diffstat (limited to 'include/linux/timerqueue.h')
0 files changed, 0 insertions, 0 deletions