lkml.org 
[lkml]   [2008]   [Nov]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[patch 48/49] hfs: fix namelength memory corruption (CVE-2008-5025)
    2.6.27-stable review patch.  If anyone has any objections, please let us know.

    ------------------

    From: Eric Sesterhenn <snakebyte@gmx.de>

    commit d38b7aa7fc3371b52d036748028db50b585ade2e upstream

    Fix a stack corruption caused by a corrupted hfs filesystem. If the
    catalog name length is corrupted the memcpy overwrites the catalog btree
    structure. Since the field is limited to HFS_NAMELEN bytes in the
    structure and the file format, we throw an error if it is too long.

    Cc: Roman Zippel <zippel@linux-m68k.org>
    Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    fs/hfs/catalog.c | 4 ++++
    1 file changed, 4 insertions(+)

    --- a/fs/hfs/catalog.c
    +++ b/fs/hfs/catalog.c
    @@ -190,6 +190,10 @@ int hfs_cat_find_brec(struct super_block

    fd->search_key->cat.ParID = rec.thread.ParID;
    len = fd->search_key->cat.CName.len = rec.thread.CName.len;
    + if (len > HFS_NAMELEN) {
    + printk(KERN_ERR "hfs: bad catalog namelength\n");
    + return -EIO;
    + }
    memcpy(fd->search_key->cat.CName.name, rec.thread.CName.name, len);
    return hfs_brec_find(fd);
    }
    --


    \
     
     \ /
      Last update: 2008-11-12 01:47    [W:4.076 / U:0.144 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site