From 8675708cb8356da419398863e9f997b5cc437bf0 Mon Sep 17 00:00:00 2001 From: Ayush Ranjan Date: Tue, 19 Sep 2023 10:46:32 -0700 Subject: [PATCH] Handle arbitrarily large Fuse Dirent Namelen. If FUSEDirent.Namelen is larger than the remaining payload size, then the dirent is probably invalid. We should skip it. PiperOrigin-RevId: 566678679 --- pkg/abi/linux/fuse.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/abi/linux/fuse.go b/pkg/abi/linux/fuse.go index 08c2aa688..6f7edde35 100644 --- a/pkg/abi/linux/fuse.go +++ b/pkg/abi/linux/fuse.go @@ -985,7 +985,7 @@ func (r *FUSEDirent) shiftNextDirent(buf []byte) []byte { func (r *FUSEDirent) UnmarshalBytes(src []byte) []byte { srcP := r.Meta.UnmarshalBytes(src) - if r.Meta.NameLen > FUSE_NAME_MAX { + if r.Meta.NameLen > FUSE_NAME_MAX || r.Meta.NameLen > uint32(len(srcP)) { // The name is too long and therefore invalid. We don't // need to unmarshal the name since it'll be thrown away. return r.shiftNextDirent(src)