diff options
author | Jan Kara <[email protected]> | 2018-06-13 12:09:22 +0200 |
---|---|---|
committer | Jan Kara <[email protected]> | 2018-06-20 11:05:31 +0200 |
commit | fa65653e575fbd958bdf5fb9c4a71a324e39510d (patch) | |
tree | d4c72542efca534caea70cab397ccf4a35ea3c2a | |
parent | 27e6ed54a30a00d6520ddb4518214df8ff99daf1 (diff) |
udf: Detect incorrect directory size
Detect when a directory entry is (possibly partially) beyond directory
size and return EIO in that case since it means the filesystem is
corrupted. Otherwise directory operations can further corrupt the
directory and possibly also oops the kernel.
CC: Anatoly Trosinenko <[email protected]>
CC: [email protected]
Reported-and-tested-by: Anatoly Trosinenko <[email protected]>
Signed-off-by: Jan Kara <[email protected]>
-rw-r--r-- | fs/udf/directory.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/fs/udf/directory.c b/fs/udf/directory.c index 0a98a2369738..3835f983cc99 100644 --- a/fs/udf/directory.c +++ b/fs/udf/directory.c @@ -152,6 +152,9 @@ struct fileIdentDesc *udf_fileident_read(struct inode *dir, loff_t *nf_pos, sizeof(struct fileIdentDesc)); } } + /* Got last entry outside of dir size - fs is corrupted! */ + if (*nf_pos > dir->i_size) + return NULL; return fi; } |