diff options
author | Linus Torvalds <torvalds@linux-foundation.org> | 2018-08-02 17:43:35 +0200 |
---|---|---|
committer | Linus Torvalds <torvalds@linux-foundation.org> | 2018-08-02 18:32:23 +0200 |
commit | 71755ee5350b63fb1f283de8561cdb61b47f4d1d (patch) | |
tree | cfca6c7e5f8f30014724b955c845a1a2e80d95e5 /fs/squashfs/file_direct.c | |
parent | Merge branch 'fixes' of git://git.armlinux.org.uk/~rmk/linux-arm (diff) | |
download | linux-71755ee5350b63fb1f283de8561cdb61b47f4d1d.tar.xz linux-71755ee5350b63fb1f283de8561cdb61b47f4d1d.zip |
squashfs: more metadata hardening
The squashfs fragment reading code doesn't actually verify that the
fragment is inside the fragment table. The end result _is_ verified to
be inside the image when actually reading the fragment data, but before
that is done, we may end up taking a page fault because the fragment
table itself might not even exist.
Another report from Anatoly and his endless squashfs image fuzzing.
Reported-by: Анатолий Тросиненко <anatoly.trosinenko@gmail.com>
Acked-by:: Phillip Lougher <phillip.lougher@gmail.com>,
Cc: Willy Tarreau <w@1wt.eu>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'fs/squashfs/file_direct.c')
0 files changed, 0 insertions, 0 deletions