]> pilppa.com Git - linux-2.6-omap-h63xx.git/commit
[PATCH] rock.c: handle corrupted directories
authorAndrew Morton <akpm@osdl.org>
Wed, 22 Jun 2005 00:16:50 +0000 (17:16 -0700)
committerLinus Torvalds <torvalds@ppc970.osdl.org>
Wed, 22 Jun 2005 02:07:38 +0000 (19:07 -0700)
commite595447e177b39aa6c96baaa57b30cde2d8b9df7
tree7c6c1be2e623fc3cefb1a0afcb51247293a393eb
parent9eb7f2c67c41d2cd730aedcd23e5baca09211d03
[PATCH] rock.c: handle corrupted directories

The bug in rock.c is that it's totally trusting of the contents of the
directories.  If the directory says there's a continuation 10000 bytes into
this 4k block then we cheerily poke around in memory we don't own and oops.

So change rock_continue() to apply various sanity checks, at least ensuring
that the offset+length remain within the bounds for the header part of a
struct rock_ridge directory entry.

Note that the kernel can still overindex the buffer due to the variable size
of the rock-ridge directory entries.  We cannot check that in rock_continue()
unless we go parse the directory entry's signature and work out its size.

Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
fs/isofs/rock.c