From: Phillip Lougher Date: Tue, 3 Sep 2013 03:38:43 +0000 (+0100) Subject: Squashfs: fix corruption checks in squashfs_readdir() X-Git-Url: https://git.karo-electronics.de/?a=commitdiff_plain;h=68e7f412370ecfeb1bd667d0d174fad34517516e;p=linux-beck.git Squashfs: fix corruption checks in squashfs_readdir() The dir_count and size fields when read from disk are sanity checked for correctness. However, the sanity checks only check the values are not greater than expected. As dir_count and size were incorrectly defined as signed ints, this can lead to corrupted values appearing as negative which are not trapped. Signed-off-by: Phillip Lougher --- diff --git a/fs/squashfs/dir.c b/fs/squashfs/dir.c index f7f527bf8c10..119208422260 100644 --- a/fs/squashfs/dir.c +++ b/fs/squashfs/dir.c @@ -105,9 +105,8 @@ static int squashfs_readdir(struct file *file, struct dir_context *ctx) struct inode *inode = file_inode(file); struct squashfs_sb_info *msblk = inode->i_sb->s_fs_info; u64 block = squashfs_i(inode)->start + msblk->directory_table; - int offset = squashfs_i(inode)->offset, length, dir_count, size, - type, err; - unsigned int inode_number; + int offset = squashfs_i(inode)->offset, length, type, err; + unsigned int inode_number, dir_count, size; struct squashfs_dir_header dirh; struct squashfs_dir_entry *dire;