mirrors
/
linux-stable
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Releases Wiki Activity

fs/adfs: bigdir: directory validation strengthening 

Strengthen the directory validation by ensuring that the header fields
contain sensible values that fit inside the directory, and limit the
directory size to 4MB as per RISC OS requirements.

Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
This commit is contained in:
Russell King 2019-12-09 11:11:02 +00:00 committed by Al Viro
parent 6674ecab90
commit aa3d4e0152
1 changed files with 28 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
fs/adfs/dir_fplus.c
View File

@ -19,11 +19,38 @@ static unsigned int adfs_fplus_offset(const struct adfs_bigdirheader *h,
static int adfs_fplus_validate_header(const struct adfs_bigdirheader *h)
{
unsigned int size = le32_to_cpu(h->bigdirsize);
unsigned int len;
if (h->bigdirversion[0] != 0 || h->bigdirversion[1] != 0 ||
h->bigdirversion[2] != 0 ||
h->bigdirstartname != cpu_to_le32(BIGDIRSTARTNAME) ||
size & 2047)
!size || size & 2047 || size > SZ_4M)
return -EIO;
size -= sizeof(struct adfs_bigdirtail) +
offsetof(struct adfs_bigdirheader, bigdirname);
/* Check that bigdirnamelen fits within the directory */
len = ALIGN(le32_to_cpu(h->bigdirnamelen), 4);
if (len > size)
return -EIO;
size -= len;
/* Check that bigdirnamesize fits within the directory */
len = le32_to_cpu(h->bigdirnamesize);
if (len > size)
return -EIO;
size -= len;
/*
* Avoid division, we know that absolute maximum number of entries
* can not be so large to cause overflow of the multiplication below.
*/
len = le32_to_cpu(h->bigdirentries);
if (len > SZ_4M / sizeof(struct adfs_bigdirentry) ||
len * sizeof(struct adfs_bigdirentry) > size)
return -EIO;
return 0;