Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Squashfs: fix corruption checks in squashfs_readdir()

Browse source 
The dir_count and size fields when read from disk are sanity
checked for correctness.  However, the sanity checks only check the
values are not greater than expected.  As dir_count and size were
incorrectly defined as signed ints, this can lead to corrupted values
appearing as negative which are not trapped.

Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>
This commit is contained in:
Phillip Lougher 2013-09-03 04:38:43 +01:00
parent 52e9ce1c0f
commit 68e7f41237
1 changed files with 2 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
fs/squashfs/dir.c
View file

@ -105,9 +105,8 @@ static int squashfs_readdir(struct file *file, struct dir_context *ctx)
struct inode *inode = file_inode(file); struct inode *inode = file_inode(file);
struct squashfs_sb_info *msblk = inode->i_sb->s_fs_info; struct squashfs_sb_info *msblk = inode->i_sb->s_fs_info;
u64 block = squashfs_i(inode)->start + msblk->directory_table; u64 block = squashfs_i(inode)->start + msblk->directory_table;
int offset = squashfs_i(inode)->offset, length, dir_count, size, int offset = squashfs_i(inode)->offset, length, type, err;
type, err; unsigned int inode_number, dir_count, size;
unsigned int inode_number;
struct squashfs_dir_header dirh; struct squashfs_dir_header dirh;
struct squashfs_dir_entry *dire; struct squashfs_dir_entry *dire;