Libguestfs - May 2012 - NTFS(-3g) large alternate data streams

(I meant to copy this message to the mailing list)

On Mon, May 28, 2012 at 05:49:36PM +0100, Richard W.M. Jones
wrote:
>
> This file has an approx 48 MB ADS:
> 
>   ><fs> ll /Temp/
>   total 13
>   drwxrwxrwx 1 root root    0 May 28 17:28 .
>   drwxrwxrwx 1 root root 4096 Nov  1  2011 ..
>   -rwxrwxrwx 1 root root   13 Oct  5  2011 ADS_test.txt
>   ><fs> getxattrs /Temp/ADS_test.txt 
>   libguestfs: error: getxattrs: getxattr: Argument list too long
> 
> The code in libguestfs tries to allocate enough space to store the
> return value using malloc.  There is a correct check on the return
> from malloc, so I don't believe there is any possible DoS here.  It
> also frees the buffer along the return path.  [However through an
> abundance of caution I'm going to modify this code to add an upper
> limit, see below.]
> 
> In any case what actually fails is the kernel call:
> 
>   vlen = getxattr (path, /* name of xattr */,
>                    /* return pointer */,
>                    /* ~ 48 MB */);
> 
> because I was wrong before when I said there was no limit at all.  In
> fact the limit in the kernel is XATTR_SIZE_MAX == 65536.
> 
> So essentially there is no chance of returning ADSes using the
> standard way.  You'll have to use the ntfs-3g streams_interface=windows
> mount option.
> 
> Rich.
> 
> -- 
> Richard Jones, Virtualization Group, Red Hat
http://people.redhat.com/~rjones
> virt-p2v converts physical machines to virtual machines.  Boot with a
> live CD or over the network (PXE) and turn machines into Xen guests.
> http://et.redhat.com/~rjones/virt-p2v
-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
virt-top is 'top' for virtual machines.  Tiny program with many
powerful monitoring features, net stats, disk stats, logging, etc.
http://et.redhat.com/~rjones/virt-top