)]}'
{
  "commit": "d50f2ab6f050311dbf7b8f5501b25f0bf64a439b",
  "tree": "a4775254db19dc589c85c36a8bd5b3c2e1be4838",
  "parents": [
    "5f163cc759a9fa8844a4efcf1f579dc5b2ca2491"
  ],
  "author": {
    "name": "Xi Wang",
    "email": "xi.wang@gmail.com",
    "time": "Tue Jan 10 11:51:10 2012 -0500"
  },
  "committer": {
    "name": "Theodore Ts\u0027o",
    "email": "tytso@mit.edu",
    "time": "Tue Jan 10 11:51:10 2012 -0500"
  },
  "message": "ext4: fix undefined behavior in ext4_fill_flex_info()\n\nCommit 503358ae01b70ce6909d19dd01287093f6b6271c (\"ext4: avoid divide by\nzero when trying to mount a corrupted file system\") fixes CVE-2009-4307\nby performing a sanity check on s_log_groups_per_flex, since it can be\nset to a bogus value by an attacker.\n\n\tsbi-\u003es_log_groups_per_flex \u003d sbi-\u003es_es-\u003es_log_groups_per_flex;\n\tgroups_per_flex \u003d 1 \u003c\u003c sbi-\u003es_log_groups_per_flex;\n\n\tif (groups_per_flex \u003c 2) { ... }\n\nThis patch fixes two potential issues in the previous commit.\n\n1) The sanity check might only work on architectures like PowerPC.\nOn x86, 5 bits are used for the shifting amount.  That means, given a\nlarge s_log_groups_per_flex value like 36, groups_per_flex \u003d 1 \u003c\u003c 36\nis essentially 1 \u003c\u003c 4 \u003d 16, rather than 0.  This will bypass the check,\nleaving s_log_groups_per_flex and groups_per_flex inconsistent.\n\n2) The sanity check relies on undefined behavior, i.e., oversized shift.\nA standard-confirming C compiler could rewrite the check in unexpected\nways.  Consider the following equivalent form, assuming groups_per_flex\nis unsigned for simplicity.\n\n\tgroups_per_flex \u003d 1 \u003c\u003c sbi-\u003es_log_groups_per_flex;\n\tif (groups_per_flex \u003d\u003d 0 || groups_per_flex \u003d\u003d 1) {\n\nWe compile the code snippet using Clang 3.0 and GCC 4.6.  Clang will\ncompletely optimize away the check groups_per_flex \u003d\u003d 0, leaving the\npatched code as vulnerable as the original.  GCC keeps the check, but\nthere is no guarantee that future versions will do the same.\n\nSigned-off-by: Xi Wang \u003cxi.wang@gmail.com\u003e\nSigned-off-by: \"Theodore Ts\u0027o\" \u003ctytso@mit.edu\u003e\nCc: stable@vger.kernel.org\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "36570b7af7c5cc59d5ff559547a6bcef21cd97fb",
      "old_mode": 33188,
      "old_path": "fs/ext4/super.c",
      "new_id": "108c3af8617b534ef31ce81d65261f6e87bcbc35",
      "new_mode": 33188,
      "new_path": "fs/ext4/super.c"
    }
  ]
}