diff options
| author | Jan Kara <jack@suse.cz> | 2008-04-30 00:52:33 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2008-04-30 08:29:33 -0700 |
| commit | 2deb1acc653cbd5384b107d050d2deba089db2bd (patch) | |
| tree | 8d9a944b7f5b08b27d849a1aaa20d6ee3851ae9e /fs/isofs/namei.c | |
| parent | 6bfe0b499082fd3950429017cd8ebf2a6c458aa5 (diff) | |
| download | op-kernel-dev-2deb1acc653cbd5384b107d050d2deba089db2bd.zip op-kernel-dev-2deb1acc653cbd5384b107d050d2deba089db2bd.tar.gz | |
isofs: fix access to unallocated memory when reading corrupted filesystem
When a directory on isofs is corrupted, we did not check whether length of the
name in a directory entry and the length of the directory entry itself are
consistent. This could lead to possible access beyond the end of buffer when
the length of the name was too big. Add this sanity check to directory
reading code.
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'fs/isofs/namei.c')
| -rw-r--r-- | fs/isofs/namei.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/fs/isofs/namei.c b/fs/isofs/namei.c index 344b247..8299889 100644 --- a/fs/isofs/namei.c +++ b/fs/isofs/namei.c @@ -111,6 +111,13 @@ isofs_find_entry(struct inode *dir, struct dentry *dentry, dlen = de->name_len[0]; dpnt = de->name; + /* Basic sanity check, whether name doesn't exceed dir entry */ + if (de_len < dlen + sizeof(struct iso_directory_record)) { + printk(KERN_NOTICE "iso9660: Corrupted directory entry" + " in block %lu of inode %lu\n", block, + dir->i_ino); + return 0; + } if (sbi->s_rock && ((i = get_rock_ridge_filename(de, tmpname, dir)))) { |
