OpenE2K
/
linux
6
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Squashfs: sanity check information from disk 

We read the size of the name from the disk, but a larger name than
expected would cause memory corruption.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>
This commit is contained in:
Dan Carpenter 2013-07-17 15:20:25 +03:00 committed by Phillip Lougher
parent d8dfad3876
commit 28d7b5684b
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
fs/squashfs/namei.c
View File

@ -79,7 +79,8 @@ static int get_dir_index_using_name(struct super_block *sb,
int len)
{
struct squashfs_sb_info *msblk = sb->s_fs_info;
int i, size, length = 0, err;
int i, length = 0, err;
unsigned int size;
struct squashfs_dir_index *index;
char *str;
@ -103,6 +104,10 @@ static int get_dir_index_using_name(struct super_block *sb,
size = le32_to_cpu(index->size) + 1;
if (size > SQUASHFS_NAME_LEN) {
err = -EINVAL;
break;
}
err = squashfs_read_metadata(sb, index->name, &index_start,
&index_offset, size);