mirror of
https://mirrors.bfsu.edu.cn/git/linux.git
synced 2024-11-25 13:14:07 +08:00
Squashfs: fix corruption checks in squashfs_readdir()
The dir_count and size fields when read from disk are sanity checked for correctness. However, the sanity checks only check the values are not greater than expected. As dir_count and size were incorrectly defined as signed ints, this can lead to corrupted values appearing as negative which are not trapped. Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>
This commit is contained in:
parent
52e9ce1c0f
commit
68e7f41237
@ -105,9 +105,8 @@ static int squashfs_readdir(struct file *file, struct dir_context *ctx)
|
||||
struct inode *inode = file_inode(file);
|
||||
struct squashfs_sb_info *msblk = inode->i_sb->s_fs_info;
|
||||
u64 block = squashfs_i(inode)->start + msblk->directory_table;
|
||||
int offset = squashfs_i(inode)->offset, length, dir_count, size,
|
||||
type, err;
|
||||
unsigned int inode_number;
|
||||
int offset = squashfs_i(inode)->offset, length, type, err;
|
||||
unsigned int inode_number, dir_count, size;
|
||||
struct squashfs_dir_header dirh;
|
||||
struct squashfs_dir_entry *dire;
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user