sleuthkit/0005-Fix-Fuzz-buffer-overflow.patch
2020-12-16 16:16:44 +08:00

63 lines
2.3 KiB
Diff

diff -Nur sleuthkit-4.6.7/tsk/fs/ext2fs.c sleuthkit-4.6.7.new/tsk/fs/ext2fs.c
--- sleuthkit-4.6.7/tsk/fs/ext2fs.c 2020-12-16 14:43:46.929902964 +0800
+++ sleuthkit-4.6.7.new/tsk/fs/ext2fs.c 2020-12-16 14:54:44.211056190 +0800
@@ -1021,8 +1021,10 @@
if ((fs_file = tsk_fs_file_alloc(fs)) == NULL)
return 1;
if ((fs_file->meta =
- tsk_fs_meta_alloc(EXT2FS_FILE_CONTENT_LEN)) == NULL)
+ tsk_fs_meta_alloc(EXT2FS_FILE_CONTENT_LEN)) == NULL) {
+ tsk_fs_file_close(fs_file);
return 1;
+ }
// we need to handle fs->last_inum specially because it is for the
// virtual ORPHANS directory. Handle it outside of the loop.
@@ -1038,6 +1040,7 @@
ext2fs->inode_size >
sizeof(ext2fs_inode) ? ext2fs->inode_size : sizeof(ext2fs_inode);
if ((dino_buf = (ext2fs_inode *) tsk_malloc(size)) == NULL) {
+ tsk_fs_file_close(fs_file);
return 1;
}
@@ -1058,6 +1061,7 @@
if (ext2fs_imap_load(ext2fs, grp_num)) {
tsk_release_lock(&ext2fs->lock);
+ tsk_fs_file_close(fs_file);
free(dino_buf);
return 1;
}
@@ -1068,8 +1072,9 @@
/*
* Ensure that inum - ibase refers to a valid bit offset in imap_buf.
*/
- if ((inum - ibase) > fs->block_size*8) {
+ if ((inum - ibase) >= fs->block_size*8) {
tsk_release_lock(&ext2fs->lock);
+ tsk_fs_file_close(fs_file);
free(dino_buf);
tsk_error_reset();
tsk_error_set_errno(TSK_ERR_FS_WALK_RNG);
@@ -1120,7 +1125,7 @@
* to the application.
*/
if (ext2fs_dinode_copy(ext2fs, fs_file->meta, inum, dino_buf)) {
- tsk_fs_meta_close(fs_file->meta);
+ tsk_fs_file_close(fs_file);
free(dino_buf);
return 1;
}
diff -Nur sleuthkit-4.6.7/tsk/fs/unix_misc.c sleuthkit-4.6.7.new/tsk/fs/unix_misc.c
--- sleuthkit-4.6.7/tsk/fs/unix_misc.c 2019-08-03 04:20:57.000000000 +0800
+++ sleuthkit-4.6.7.new/tsk/fs/unix_misc.c 2020-12-16 14:56:46.852764086 +0800
@@ -180,6 +180,7 @@
}
tsk_error_set_errstr2("unix_make_data_run_indir: Block %"
PRIuDADDR, addr);
+ free(data_run);
return -1;
}
}