Commit 28d7b568 authored by Dan Carpenter's avatar Dan Carpenter Committed by Phillip Lougher
Browse files

Squashfs: sanity check information from disk 



We read the size of the name from the disk, but a larger name than
expected would cause memory corruption.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarPhillip Lougher <phillip@squashfs.org.uk>
parent d8dfad38

fs/squashfs/namei.c

+6 −1
Original line number Diff line number Diff line
@@ -79,7 +79,8 @@ static int get_dir_index_using_name(struct super_block *sb, 
			int len)

{

	struct squashfs_sb_info *msblk = sb->s_fs_info;

	int i, size, length = 0, err;

	int i, length = 0, err;

	unsigned int size;

	struct squashfs_dir_index *index;

	char *str;
@@ -103,6 +104,10 @@ static int get_dir_index_using_name(struct super_block *sb, 




		size = le32_to_cpu(index->size) + 1;

		if (size > SQUASHFS_NAME_LEN) {

			err = -EINVAL;

			break;

		}



		err = squashfs_read_metadata(sb, index->name, &index_start,

					&index_offset, size);