Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 68e7f412 authored by Phillip Lougher's avatar Phillip Lougher
Browse files

Squashfs: fix corruption checks in squashfs_readdir() 



The dir_count and size fields when read from disk are sanity
checked for correctness.  However, the sanity checks only check the
values are not greater than expected.  As dir_count and size were
incorrectly defined as signed ints, this can lead to corrupted values
appearing as negative which are not trapped.

Signed-off-by: default avatarPhillip Lougher <phillip@squashfs.org.uk>
parent 52e9ce1c

fs/squashfs/dir.c

+2 −3
Original line number Diff line number Diff line
@@ -105,9 +105,8 @@ static int squashfs_readdir(struct file *file, struct dir_context *ctx) 
	struct inode *inode = file_inode(file);

	struct squashfs_sb_info *msblk = inode->i_sb->s_fs_info;

	u64 block = squashfs_i(inode)->start + msblk->directory_table;

	int offset = squashfs_i(inode)->offset, length, dir_count, size,

				type, err;

	unsigned int inode_number;

	int offset = squashfs_i(inode)->offset, length, type, err;

	unsigned int inode_number, dir_count, size;

	struct squashfs_dir_header dirh;

	struct squashfs_dir_entry *dire;