summaryrefslogtreecommitdiffstats
path: root/fs/isofs
diff options
context:
space:
mode:
authorJan Kara <jack@suse.cz>2021-10-18 12:37:41 +0200
committerJan Kara <jack@suse.cz>2021-10-19 12:51:02 +0200
commite96a1866b40570b5950cda8602c2819189c62a48 (patch)
treebc072688dd9d5cf68965fb96e6f34de6c9675151 /fs/isofs
parentquota: correct error number in free_dqentry() (diff)
downloadlinux-e96a1866b40570b5950cda8602c2819189c62a48.tar.xz
linux-e96a1866b40570b5950cda8602c2819189c62a48.zip
isofs: Fix out of bound access for corrupted isofs image
When isofs image is suitably corrupted isofs_read_inode() can read data beyond the end of buffer. Sanity-check the directory entry length before using it. Reported-and-tested-by: syzbot+6fc7fb214625d82af7d1@syzkaller.appspotmail.com CC: stable@vger.kernel.org Signed-off-by: Jan Kara <jack@suse.cz>
Diffstat (limited to 'fs/isofs')
-rw-r--r--fs/isofs/inode.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
index 678e2c51b855..0c6eacfcbeef 100644
--- a/fs/isofs/inode.c
+++ b/fs/isofs/inode.c
@@ -1322,6 +1322,8 @@ static int isofs_read_inode(struct inode *inode, int relocated)
de = (struct iso_directory_record *) (bh->b_data + offset);
de_len = *(unsigned char *) de;
+ if (de_len < sizeof(struct iso_directory_record))
+ goto fail;
if (offset + de_len > bufsize) {
int frag1 = bufsize - offset;