summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorPhillip Lougher <phillip@squashfs.org.uk>2013-09-03 04:38:43 +0100
committerPhillip Lougher <phillip@squashfs.org.uk>2013-09-06 04:57:53 +0100
commit68e7f412370ecfeb1bd667d0d174fad34517516e (patch)
tree60d41e9366a38c45f836cf72403b6495e3763f4a
parent52e9ce1c0f2060661e147ffaf701a17f2fc0a153 (diff)
downloadlinux-stable-68e7f412370ecfeb1bd667d0d174fad34517516e.tar.gz
linux-stable-68e7f412370ecfeb1bd667d0d174fad34517516e.tar.bz2
linux-stable-68e7f412370ecfeb1bd667d0d174fad34517516e.zip
Squashfs: fix corruption checks in squashfs_readdir()
The dir_count and size fields when read from disk are sanity checked for correctness. However, the sanity checks only check the values are not greater than expected. As dir_count and size were incorrectly defined as signed ints, this can lead to corrupted values appearing as negative which are not trapped. Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>
-rw-r--r--fs/squashfs/dir.c5
1 files changed, 2 insertions, 3 deletions
diff --git a/fs/squashfs/dir.c b/fs/squashfs/dir.c
index f7f527bf8c10..119208422260 100644
--- a/fs/squashfs/dir.c
+++ b/fs/squashfs/dir.c
@@ -105,9 +105,8 @@ static int squashfs_readdir(struct file *file, struct dir_context *ctx)
struct inode *inode = file_inode(file);
struct squashfs_sb_info *msblk = inode->i_sb->s_fs_info;
u64 block = squashfs_i(inode)->start + msblk->directory_table;
- int offset = squashfs_i(inode)->offset, length, dir_count, size,
- type, err;
- unsigned int inode_number;
+ int offset = squashfs_i(inode)->offset, length, type, err;
+ unsigned int inode_number, dir_count, size;
struct squashfs_dir_header dirh;
struct squashfs_dir_entry *dire;