浏览代码

Check input buffer size in zisofs

This uses the new deflateBound() thing to sanity-check the input to the
zlib decompressor before we even bother to start reading in the blocks.

Problem noted by Tim Yamin <plasmaroo@gentoo.org>
Linus Torvalds 20 年之前
父节点
当前提交
fab5a60a29
共有 1 个文件被更改,包括 6 次插入0 次删除
  1. 6 0
      fs/isofs/compress.c

+ 6 - 0
fs/isofs/compress.c

@@ -129,8 +129,14 @@ static int zisofs_readpage(struct file *file, struct page *page)
 	cend = le32_to_cpu(*(__le32 *)(bh->b_data + (blockendptr & bufmask)));
 	brelse(bh);
 
+	if (cstart > cend)
+		goto eio;
+		
 	csize = cend-cstart;
 
+	if (csize > deflateBound(1UL << zisofs_block_shift))
+		goto eio;
+
 	/* Now page[] contains an array of pages, any of which can be NULL,
 	   and the locks on which we hold.  We should now read the data and
 	   release the pages.  If the pages are NULL the decompressed data