diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2013-07-17 15:20:25 +0300 |
|---|---|---|
| committer | Mister Oyster <oysterized@gmail.com> | 2017-04-11 11:00:14 +0200 |
| commit | 3d2784510a184657f16f68891374be91adff0749 (patch) | |
| tree | 5809d65a66c32f272853ca0f62dba9251414d0d9 | |
| parent | 7a6e637f53edfde90a159b32329d865f856c8bf4 (diff) | |
Squashfs: sanity check information from disk
We read the size of the name from the disk, but a larger name than
expected would cause memory corruption.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>
Change-Id: Ia307b9c023bf1c7c024bb1d90302aea527b66997
| -rw-r--r-- | fs/squashfs/namei.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/fs/squashfs/namei.c b/fs/squashfs/namei.c index 7834a517f..f866d42a8 100644 --- a/fs/squashfs/namei.c +++ b/fs/squashfs/namei.c @@ -79,7 +79,8 @@ static int get_dir_index_using_name(struct super_block *sb, int len) { struct squashfs_sb_info *msblk = sb->s_fs_info; - int i, size, length = 0, err; + int i, length = 0, err; + unsigned int size; struct squashfs_dir_index *index; char *str; @@ -103,6 +104,10 @@ static int get_dir_index_using_name(struct super_block *sb, size = le32_to_cpu(index->size) + 1; + if (size > SQUASHFS_NAME_LEN) { + err = -EINVAL; + break; + } err = squashfs_read_metadata(sb, index->name, &index_start, &index_offset, size); |