mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-28 21:33:52 +00:00
squashfs: fix xattr id and id lookup sanity checks
commit8b44ca2b63
upstream. The checks for maximum metadata block size is missing SQUASHFS_BLOCK_OFFSET (the two byte length count). Link: https://lkml.kernel.org/r/2069685113.2081245.1614583677427@webmail.123-reg.co.uk Fixes:f37aa4c736
("squashfs: add more sanity checks in id lookup") Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk> Cc: Sean Nyekjaer <sean@geanix.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
c7f99ec83c
commit
0e437601a8
2 changed files with 8 additions and 4 deletions
|
@ -110,14 +110,16 @@ __le64 *squashfs_read_id_index_table(struct super_block *sb,
|
||||||
start = le64_to_cpu(table[n]);
|
start = le64_to_cpu(table[n]);
|
||||||
end = le64_to_cpu(table[n + 1]);
|
end = le64_to_cpu(table[n + 1]);
|
||||||
|
|
||||||
if (start >= end || (end - start) > SQUASHFS_METADATA_SIZE) {
|
if (start >= end || (end - start) >
|
||||||
|
(SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) {
|
||||||
kfree(table);
|
kfree(table);
|
||||||
return ERR_PTR(-EINVAL);
|
return ERR_PTR(-EINVAL);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
start = le64_to_cpu(table[indexes - 1]);
|
start = le64_to_cpu(table[indexes - 1]);
|
||||||
if (start >= id_table_start || (id_table_start - start) > SQUASHFS_METADATA_SIZE) {
|
if (start >= id_table_start || (id_table_start - start) >
|
||||||
|
(SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) {
|
||||||
kfree(table);
|
kfree(table);
|
||||||
return ERR_PTR(-EINVAL);
|
return ERR_PTR(-EINVAL);
|
||||||
}
|
}
|
||||||
|
|
|
@ -122,14 +122,16 @@ __le64 *squashfs_read_xattr_id_table(struct super_block *sb, u64 table_start,
|
||||||
start = le64_to_cpu(table[n]);
|
start = le64_to_cpu(table[n]);
|
||||||
end = le64_to_cpu(table[n + 1]);
|
end = le64_to_cpu(table[n + 1]);
|
||||||
|
|
||||||
if (start >= end || (end - start) > SQUASHFS_METADATA_SIZE) {
|
if (start >= end || (end - start) >
|
||||||
|
(SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) {
|
||||||
kfree(table);
|
kfree(table);
|
||||||
return ERR_PTR(-EINVAL);
|
return ERR_PTR(-EINVAL);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
start = le64_to_cpu(table[indexes - 1]);
|
start = le64_to_cpu(table[indexes - 1]);
|
||||||
if (start >= table_start || (table_start - start) > SQUASHFS_METADATA_SIZE) {
|
if (start >= table_start || (table_start - start) >
|
||||||
|
(SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) {
|
||||||
kfree(table);
|
kfree(table);
|
||||||
return ERR_PTR(-EINVAL);
|
return ERR_PTR(-EINVAL);
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in a new issue