hfsplus: Add additional range check to handle on-disk corruptions

'recoff' is read from disk and used for an argument to memcpy, so if the value read from disk is larger than the page size, it result to "general protection fault". This patch add additional range check for the value, so that disk fuzz won't cause such fault. Signed-off-by: Naohiro Aota <naota@elisp.net> Signed-off-by: Christoph Hellwig <hch@lst.de>

hfsplus: Add additional range check to handle on-disk corruptions
'recoff' is read from disk and used for an argument to memcpy, so if the value read from disk is larger than the page size, it result to "general protection fault". This patch add additional range check for the value, so that disk fuzz won't cause such fault. Signed-off-by: Naohiro Aota <naota@elisp.net> Signed-off-by: Christoph Hellwig <hch@lst.de>
Naohiro Aota · Christoph Hellwig
1 parent dd7f3d5458
Showing 1 changed file with 4 additions and 0 deletions Side-by-side Diff
fs/hfsplus/brec.c
@@ -43,6 +43,10 @@
 			node->tree->node_size - (rec + 1) * 2);
 		if (!recoff)
 			return 0;
+		if (recoff > node->tree->node_size - 2) {
+			printk(KERN_ERR "hfs: recoff %d too large\n", recoff);
+			return 0;
+		}
  
 		retval = hfs_bnode_read_u16(node, recoff) + 2;
 		if (retval > node->tree->max_key_len + 2) {
...	...	@@ -43,6 +43,10 @@
43	43	node->tree->node_size - (rec + 1) * 2);
44	44	if (!recoff)
45	45	return 0;
	46	+ if (recoff > node->tree->node_size - 2) {
	47	+ printk(KERN_ERR "hfs: recoff %d too large\n", recoff);
	48	+ return 0;
	49	+ }
46	50
47	51	retval = hfs_bnode_read_u16(node, recoff) + 2;
48	52	if (retval > node->tree->max_key_len + 2) {