[PATCH] fs/ntfs3: bound FILE_NAME name_len in ntfs_read_mft()

[Marouane El Moufid]

When reading an MFT record attribute of type ATTR_NAME, ntfs_read_mft()
validates only the fixed FILE_NAME header (SIZEOF_ATTRIBUTE_FILENAME)
against the resident attribute size, but never bounds the variable name
length. A crafted record with fname->name_len up to 255 and a minimal
resident size then makes ntfs_cmp_names_cpu() read fname->name past the
end of the MFT-record buffer (KASAN: slab-out-of-bounds, read of size 2),
reachable from a mounted crafted NTFS image by a stat() of the name.

The directory enumeration path (ntfs_dir_emit) already bounds the name
against the entry size; apply the same bound here using the existing
fname_full_size() helper.

Signed-off-by: Marouane El Moufid <eun0us@xxxxxxxxxxx>
---
 fs/ntfs3/inode.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c
--- a/fs/ntfs3/inode.c
+++ b/fs/ntfs3/inode.c
@@ -202,6 +202,8 @@

 		names += 1;
 		fname = Add2Ptr(attr, roff);
+		if (fname_full_size(fname) > rsize)
+			goto out;
 		if (fname->type == FILE_NAME_DOS)
 			goto next_attr;