summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorPhillip Lougher <phillip@squashfs.org.uk>2013-09-03 04:52:52 +0100
committerPhillip Lougher <phillip@squashfs.org.uk>2013-09-06 04:57:53 +0100
commitf960cae5357d8e52b8af91e8b1621cae565dffb3 (patch)
tree0b1abaf2638d2bb842206e27009c5383687974f0
parent68e7f412370ecfeb1bd667d0d174fad34517516e (diff)
downloadop-kernel-dev-f960cae5357d8e52b8af91e8b1621cae565dffb3.zip
op-kernel-dev-f960cae5357d8e52b8af91e8b1621cae565dffb3.tar.gz
Squashfs: add corruption check in get_dir_index_using_offset()
We read the size (of the name) field from disk. This value should be sanity checked for correctness to avoid blindly reading huge amounts of unnecessary data from disk on corruption. Note, here we're not actually reading the name into a buffer, but skipping it, and so corruption doesn't cause buffer overflow, merely lots of unnecessary amounts of data to be read. Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>
-rw-r--r--fs/squashfs/dir.c9
1 files changed, 8 insertions, 1 deletions
diff --git a/fs/squashfs/dir.c b/fs/squashfs/dir.c
index 1192084..bd7155b 100644
--- a/fs/squashfs/dir.c
+++ b/fs/squashfs/dir.c
@@ -54,6 +54,7 @@ static int get_dir_index_using_offset(struct super_block *sb,
{
struct squashfs_sb_info *msblk = sb->s_fs_info;
int err, i, index, length = 0;
+ unsigned int size;
struct squashfs_dir_index dir_index;
TRACE("Entered get_dir_index_using_offset, i_count %d, f_pos %lld\n",
@@ -81,8 +82,14 @@ static int get_dir_index_using_offset(struct super_block *sb,
*/
break;
+ size = le32_to_cpu(dir_index.size) + 1;
+
+ /* size should never be larger than SQUASHFS_NAME_LEN */
+ if (size > SQUASHFS_NAME_LEN)
+ break;
+
err = squashfs_read_metadata(sb, NULL, &index_start,
- &index_offset, le32_to_cpu(dir_index.size) + 1);
+ &index_offset, size);
if (err < 0)
break;
OpenPOWER on IntegriCloud