Attachment 45715 Details for Bug 104085

[patch] zisofs-fix.diff

zisofs-fix.diff (text/plain), 1.05 KB, created by Marcus Meissner on 2005-08-11 11:39:25 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Marcus Meissner

Created: 2005-08-11 11:39:25 UTC

Size: 1.05 KB

patch

obsolete

>From: Linus Torvalds <torvalds@g5.osdl.org>
>Date: Sat, 6 Aug 2005 16:42:06 +0000 (-0700)
>Subject: Check input buffer size in zisofs
>X-Git-Tag: v2.6.13-rc6
>X-Git-Url: http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=fab5a60a29f98f17256a4183e34a414f6db67569
>
>  Check input buffer size in zisofs
>  
>  This uses the new deflateBound() thing to sanity-check the input to the
>  zlib decompressor before we even bother to start reading in the blocks.
>  
>  Problem noted by Tim Yamin <plasmaroo@gentoo.org>
>---
>
>--- a/fs/isofs/compress.c
>+++ b/fs/isofs/compress.c
>@@ -129,8 +129,14 @@ static int zisofs_readpage(struct file *
> 	cend = le32_to_cpu(*(__le32 *)(bh->b_data + (blockendptr & bufmask)));
> 	brelse(bh);
> 
>+	if (cstart > cend)
>+		goto eio;
>+		
> 	csize = cend-cstart;
> 
>+	if (csize > deflateBound(1UL << zisofs_block_shift))
>+		goto eio;
>+
> 	/* Now page[] contains an array of pages, any of which can be NULL,
> 	   and the locks on which we hold.  We should now read the data and
> 	   release the pages.  If the pages are NULL the decompressed data

Actions: View | Diff

Attachments on bug 104085: 45714 | 45715 | 45717