CVE-2022-49762

In the Linux kernel, the following vulnerability has been resolved:

ntfs: check overflow when iterating ATTR_RECORDs

Kernel iterates over ATTRRECORDs in mft record in ntfsattrfind(). Because the ATTRRECORDs are next to each other, kernel can get the next ATTRRECORD from end address of current ATTRRECORD, through current ATTR_RECORD length field.

The problem is that during iteration, when kernel calculates the end address of current ATTR_RECORD, kernel may trigger an integer overflow bug in executing a = (ATTR_RECORD*)((u8*)a + le32_to_cpu(a->length)). This may wrap, leading to a forever iteration on 32bit systems.

This patch solves it by adding some checks on calculating end address of current ATTR_RECORD during iteration.