diff options
| author | Phillip Lougher <phillip@squashfs.org.uk> | 2013-09-03 04:21:52 +0100 |
|---|---|---|
| committer | Mister Oyster <oysterized@gmail.com> | 2017-04-11 11:00:15 +0200 |
| commit | ade1330913a63ebca40b2fd507031e83463d6249 (patch) | |
| tree | da6d5fe2168bb6b636974686478b766f8b56be0f | |
| parent | 4a0701698d0128b64a8e149a516d034c232520fb (diff) | |
Squashfs: fix corruption checks in squashfs_lookup()
The dir_count and size fields when read from disk are sanity
checked for correctness. However, the sanity checks only check the
values are not greater than expected. As dir_count and size were
incorrectly defined as signed ints, this can lead to corrupted values
appearing as negative which are not trapped.
Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>
Change-Id: Iadcc635658dcc7dd1ce940cb0537e5ebccca471a
| -rw-r--r-- | fs/squashfs/namei.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/fs/squashfs/namei.c b/fs/squashfs/namei.c index 342a5aa5a..67cad77fe 100644 --- a/fs/squashfs/namei.c +++ b/fs/squashfs/namei.c @@ -147,7 +147,8 @@ static struct dentry *squashfs_lookup(struct inode *dir, struct dentry *dentry, struct squashfs_dir_entry *dire; u64 block = squashfs_i(dir)->start + msblk->directory_table; int offset = squashfs_i(dir)->offset; - int err, length, dir_count, size; + int err, length; + unsigned int dir_count, size; TRACE("Entered squashfs_lookup [%llx:%x]\n", block, offset); |