Doug / smarc-fsl-linux-kernel

Download as
Browse Code ยป

Commit f3065f60ddfd4b5e34a412851d91d0cf27cdbf7e

Authored by Phillip Lougher
1 parent 79cb8ced7e
Exists in master and in 7 other branches imx_3.0.35_4.1.0, imx_3.10.17_1.0.1_ga, imx_3.10.53_1.1.0_ga, imx_3.14.28_1.0.0_ga, smarc-imx_3.10.53_1.1.0_ga, smarc-imx_3.14.28_1.0.0_ga, smarc-l5.0.0_1.0.0-ga

Squashfs: fix block size use in LZO decompressor 

Sizing the buffer using block size alone is incorrect leading
to a potential buffer over-run on 4K block size file systems
(because the metadata block size is always 8K).  Srclength is
set to the maximum expected size of the decompressed block and
it is block_size or 8K depending on whether a data or metadata
block is being decompressed.

Signed-off-by: Phillip Lougher <phillip@lougher.demon.co.uk>

Showing 1 changed file with 5 additions and 3 deletions Side-by-side Diff

fs/squashfs/lzo_wrapper.c
Diff comments   View file @ f3065f6
... ... @@ -40,13 +40,15 @@
40 40  
41 41 static void *lzo_init(struct squashfs_sb_info *msblk)
42 42 {
  43 + int block_size = max_t(int, msblk->block_size, SQUASHFS_METADATA_SIZE);
  44 +
43 45 struct squashfs_lzo *stream = kzalloc(sizeof(*stream), GFP_KERNEL);
44 46 if (stream == NULL)
45 47 goto failed;
46   - stream->input = vmalloc(msblk->block_size);
  48 + stream->input = vmalloc(block_size);
47 49 if (stream->input == NULL)
48 50 goto failed;
49   - stream->output = vmalloc(msblk->block_size);
  51 + stream->output = vmalloc(block_size);
50 52 if (stream->output == NULL)
51 53 goto failed2;
52 54  
... ... @@ -80,7 +82,7 @@
80 82 struct squashfs_lzo *stream = msblk->stream;
81 83 void *buff = stream->input;
82 84 int avail, i, bytes = length, res;
83   - size_t out_len = msblk->block_size;
  85 + size_t out_len = srclength;
84 86  
85 87 mutex_lock(&msblk->read_data_mutex);
86 88