Commit e96a1866 authored by Jan Kara's avatar Jan Kara
Browse files

isofs: Fix out of bound access for corrupted isofs image 



When isofs image is suitably corrupted isofs_read_inode() can read data
beyond the end of buffer. Sanity-check the directory entry length before
using it.

Reported-and-tested-by: default avatar <syzbot+6fc7fb214625d82af7d1@syzkaller.appspotmail.com>
CC: stable@vger.kernel.org
Signed-off-by: default avatarJan Kara <jack@suse.cz>
parent d0e36a62

fs/isofs/inode.c

+2 −0
Original line number Diff line number Diff line
@@ -1322,6 +1322,8 @@ static int isofs_read_inode(struct inode *inode, int relocated) 


	de = (struct iso_directory_record *) (bh->b_data + offset);

	de_len = *(unsigned char *) de;

	if (de_len < sizeof(struct iso_directory_record))

		goto fail;



	if (offset + de_len > bufsize) {

		int frag1 = bufsize - offset;