Squashfs: fix corruption checks in squashfs_readdir() (68e7f412) · Commits · 戴 / test

The dir_count and size fields when read from disk are sanity checked for correctness. However, the sanity checks only check the values are not greater than expected. As dir_count and size were incorrectly defined as signed ints, this can lead to corrupted values appearing as negative which are not trapped. Signed-off-by:

Phillip Lougher <phillip@squashfs.org.uk>

fs/squashfs/dir.c

+2 −3

Original line number	Diff line number	Diff line
		@@ -105,9 +105,8 @@ static int squashfs_readdir(struct file file, struct dir_context ctx)
		struct inode *inode = file_inode(file);
		struct squashfs_sb_info *msblk = inode->i_sb->s_fs_info;
		u64 block = squashfs_i(inode)->start + msblk->directory_table;
		int offset = squashfs_i(inode)->offset, length, dir_count, size,
		type, err;
		unsigned int inode_number;
		int offset = squashfs_i(inode)->offset, length, type, err;
		unsigned int inode_number, dir_count, size;
		struct squashfs_dir_header dirh;
		struct squashfs_dir_entry *dire;

Admin message