dect
/
linux-2.6
Archived
13
0
Fork 0
Code Releases Activity

hfsplus: Add additional range check to handle on-disk corruptions 

'recoff' is read from disk and used for an argument to memcpy, so if
the value read from disk is larger than the page size, it result to
"general protection fault". This patch add additional range check for
the value, so that disk fuzz won't cause such fault.

Signed-off-by: Naohiro Aota <naota@elisp.net>
Signed-off-by: Christoph Hellwig <hch@lst.de>
This commit is contained in:
Naohiro Aota 2011-07-12 02:54:13 +09:00 committed by Christoph Hellwig
parent dd7f3d5458
commit aac4e4198e
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
fs/hfsplus/brec.c
View File

@ -43,6 +43,10 @@ u16 hfs_brec_keylen(struct hfs_bnode *node, u16 rec)
node->tree->node_size - (rec + 1) * 2);
if (!recoff)
return 0;
if (recoff > node->tree->node_size - 2) {
printk(KERN_ERR "hfs: recoff %d too large\n", recoff);
return 0;
}
retval = hfs_bnode_read_u16(node, recoff) + 2;
if (retval > node->tree->max_key_len + 2) {