Doug / smarc-fsl-linux-kernel

Download as
Browse Code ยป

Commit d38b7aa7fc3371b52d036748028db50b585ade2e

Authored by Eric Sesterhenn
Committed by Linus Torvalds
1 parent 649f1ee6c7
Exists in master and in 7 other branches imx_3.0.35_4.1.0, imx_3.10.17_1.0.1_ga, imx_3.10.53_1.1.0_ga, imx_3.14.28_1.0.0_ga, smarc-imx_3.10.53_1.1.0_ga, smarc-imx_3.14.28_1.0.0_ga, smarc-l5.0.0_1.0.0-ga

hfs: fix namelength memory corruption 

Fix a stack corruption caused by a corrupted hfs filesystem.  If the
catalog name length is corrupted the memcpy overwrites the catalog btree
structure.  Since the field is limited to HFS_NAMELEN bytes in the
structure and the file format, we throw an error if it is too long.

Cc: Roman Zippel <zippel@linux-m68k.org>
Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Showing 1 changed file with 4 additions and 0 deletions Side-by-side Diff

... ... @@ -190,6 +190,10 @@
190 190  
191 191 fd->search_key->cat.ParID = rec.thread.ParID;
192 192 len = fd->search_key->cat.CName.len = rec.thread.CName.len;
  193 + if (len > HFS_NAMELEN) {
  194 + printk(KERN_ERR "hfs: bad catalog namelength\n");
  195 + return -EIO;
  196 + }
193 197 memcpy(fd->search_key->cat.CName.name, rec.thread.CName.name, len);
194 198 return hfs_brec_find(fd);
195 199 }