diff options
| author | Phillip Lougher <phillip@squashfs.org.uk> | 2013-09-03 04:38:43 +0100 |
|---|---|---|
| committer | Mister Oyster <oysterized@gmail.com> | 2017-04-11 11:00:15 +0200 |
| commit | 72a50f611b418a77b34d44354ab32378dffa2889 (patch) | |
| tree | 727de55a23804068cada747878a8ee24fde5f2b9 | |
| parent | ade1330913a63ebca40b2fd507031e83463d6249 (diff) | |
Squashfs: fix corruption checks in squashfs_readdir()
The dir_count and size fields when read from disk are sanity
checked for correctness. However, the sanity checks only check the
values are not greater than expected. As dir_count and size were
incorrectly defined as signed ints, this can lead to corrupted values
appearing as negative which are not trapped.
Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>
Change-Id: Id72c1e19289eb445a29d0a504677c62f18ac1bd2
| -rw-r--r-- | fs/squashfs/dir.c | 5 |
1 files changed, 2 insertions, 3 deletions
diff --git a/fs/squashfs/dir.c b/fs/squashfs/dir.c index f7f527bf8..119208422 100644 --- a/fs/squashfs/dir.c +++ b/fs/squashfs/dir.c @@ -105,9 +105,8 @@ static int squashfs_readdir(struct file *file, struct dir_context *ctx) struct inode *inode = file_inode(file); struct squashfs_sb_info *msblk = inode->i_sb->s_fs_info; u64 block = squashfs_i(inode)->start + msblk->directory_table; - int offset = squashfs_i(inode)->offset, length, dir_count, size, - type, err; - unsigned int inode_number; + int offset = squashfs_i(inode)->offset, length, type, err; + unsigned int inode_number, dir_count, size; struct squashfs_dir_header dirh; struct squashfs_dir_entry *dire; |