diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2014-12-29 20:43:10 -0800 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2014-12-29 20:43:10 -0800 |
| commit | b9d4a35f0a5dd25b85462741a8fb539b355ea95c (patch) | |
| tree | a4c08e5f651de4d1c324dddf21e7c3149a949387 /fs/isofs | |
| parent | df90dcd1007bc498927afea18ccfaae02e361707 (diff) | |
| parent | 3ee3039c5b4d121d56dc6b7deeeee3ba4150a260 (diff) | |
| download | linux-b9d4a35f0a5dd25b85462741a8fb539b355ea95c.tar.bz2 | |
Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs
Pull UDF & isofs fixes from Jan Kara:
"A couple of UDF fixes of handling of corrupted media and one iso9660
fix of the same"
* 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
udf: Reduce repeated dereferences
udf: Check component length before reading it
udf: Check path length when reading symlink
udf: Verify symlink size before loading it
udf: Verify i_size when loading inode
isofs: Fix unchecked printing of ER records
Diffstat (limited to 'fs/isofs')
| -rw-r--r-- | fs/isofs/rock.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/fs/isofs/rock.c b/fs/isofs/rock.c index bb63254ed848..735d7522a3a9 100644 --- a/fs/isofs/rock.c +++ b/fs/isofs/rock.c @@ -362,6 +362,9 @@ repeat: rs.cont_size = isonum_733(rr->u.CE.size); break; case SIG('E', 'R'): + /* Invalid length of ER tag id? */ + if (rr->u.ER.len_id + offsetof(struct rock_ridge, u.ER.data) > rr->len) + goto out; ISOFS_SB(inode->i_sb)->s_rock = 1; printk(KERN_DEBUG "ISO 9660 Extensions: "); { |