Menu

#133 invalid file name lengths in ex2fs_dir_iterate()

open
libext2 (27)
5
2012-11-28
2005-10-21
Anonymous
No

Summary
------------------
ex2fs_dir_iterate() initializes directory entry name
lengths with bogus values.

Version
------------------
$ rpm -q e2fsprogs
e2fsprogs-1.38-0.FC4.1

Example
------------------
(see attached code)

$ sudo sh mkfs.sh
$ gcc -Wall -lext2fs testdiriterate.c
$ ./testdiriterate
. : inode 2 : namelen 513 : reclen 12
.. : inode 2 : namelen 514 : reclen 12
lost+found : inode 11 : namelen 522 : reclen 20
testfile : inode 12 : namelen 264 :
reclen 980

Direntry name lengths are clearly wrong.

Attached code
------------------

--- MKFS.SH ---
#!/bin/sh

FS_FILE=/tmp/__ext2fstest

dd if=/dev/zero of=$FS_FILE bs=1M count=5
/sbin/mke2fs $FS_FILE
mount -o loop $FS_FILE /mnt

touch /mnt/testfile

umount /mnt

--- TESTDIRITERATE.C ---
#include <string.h>
#include <stdio.h>

#include <ext2fs/ext2_fs.h>
#include <ext2fs/ext2fs.h>
#include <ext2fs/ext2_err.h>

extern io_manager unix_io_manager;

static int dir_callback(struct ext2_dir_entry *dirent,
int offset, int blocksize, char *buf, void *fs_object)
{
printf("%s\t: inode %d\t: namelen %u\t: reclen %d\n",
dirent->name, dirent->inode,
dirent->name_len, dirent->rec_len);
return 0;
}

int main()
{
ext2_filsys fs;

ext2fs\_open\("/tmp/\_\_ext2fstest", 0, 0, 0,

unix_io_manager, &fs);
ext2fs_dir_iterate(fs, EXT2_ROOT_INO, 0, 0,
dir_callback, 0);

return 0;

}

Discussion

  • Theodore Ts'o

    Theodore Ts'o - 2005-10-25

    Logged In: YES
    user_id=628

    You have to mask off the low 8 bits of name_len; the upper 8
    bits of name_len are used to store the file type hint.

    There is a new ext2_dir_entry_2 structure which corresponds
    to this new layout, but it hasn't been worth it create a new
    dir_interate_2 API just to use this new data structure.
    It's just been easy to tell applications to mask off the
    high 8 bits.

     
  • Nobody/Anonymous

    Logged In: NO

    please consider updating the documentation