lkml.org 
[lkml]   [2012]   [Oct]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[ 053/180] hfsplus: Fix potential buffer overflows
    2.6.32-longterm review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    commit 6f24f892871acc47b40dd594c63606a17c714f77 upstream

    Commit ec81aecb2966 ("hfs: fix a potential buffer overflow") fixed a few
    potential buffer overflows in the hfs filesystem. But as Timo Warns
    pointed out, these changes also need to be made on the hfsplus
    filesystem as well.

    Reported-by: Timo Warns <warns@pre-sense.de>
    Acked-by: WANG Cong <amwang@redhat.com>
    Cc: Alexey Khoroshilov <khoroshilov@ispras.ru>
    Cc: Miklos Szeredi <mszeredi@suse.cz>
    Cc: Sage Weil <sage@newdream.net>
    Cc: Eugene Teo <eteo@redhat.com>
    Cc: Roman Zippel <zippel@linux-m68k.org>
    Cc: Al Viro <viro@zeniv.linux.org.uk>
    Cc: Christoph Hellwig <hch@lst.de>
    Cc: Alexey Dobriyan <adobriyan@gmail.com>
    Cc: Dave Anderson <anderson@redhat.com>
    Cc: stable <stable@vger.kernel.org>
    Cc: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    [dannf: backported to Debian's 2.6.32]
    Signed-off-by: Willy Tarreau <w@1wt.eu>
    ---
    fs/hfsplus/catalog.c | 4 ++++
    fs/hfsplus/dir.c | 11 +++++++++++
    2 files changed, 15 insertions(+), 0 deletions(-)

    diff --git a/fs/hfsplus/catalog.c b/fs/hfsplus/catalog.c
    index f6874ac..a0786c6 100644
    --- a/fs/hfsplus/catalog.c
    +++ b/fs/hfsplus/catalog.c
    @@ -329,6 +329,10 @@ int hfsplus_rename_cat(u32 cnid,
    err = hfs_brec_find(&src_fd);
    if (err)
    goto out;
    + if (src_fd.entrylength > sizeof(entry) || src_fd.entrylength < 0) {
    + err = -EIO;
    + goto out;
    + }

    hfs_bnode_read(src_fd.bnode, &entry, src_fd.entryoffset,
    src_fd.entrylength);
    diff --git a/fs/hfsplus/dir.c b/fs/hfsplus/dir.c
    index 5f40236..f4300ff7 100644
    --- a/fs/hfsplus/dir.c
    +++ b/fs/hfsplus/dir.c
    @@ -138,6 +138,11 @@ static int hfsplus_readdir(struct file *filp, void *dirent, filldir_t filldir)
    filp->f_pos++;
    /* fall through */
    case 1:
    + if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) {
    + err = -EIO;
    + goto out;
    + }
    +
    hfs_bnode_read(fd.bnode, &entry, fd.entryoffset, fd.entrylength);
    if (be16_to_cpu(entry.type) != HFSPLUS_FOLDER_THREAD) {
    printk(KERN_ERR "hfs: bad catalog folder thread\n");
    @@ -168,6 +173,12 @@ static int hfsplus_readdir(struct file *filp, void *dirent, filldir_t filldir)
    err = -EIO;
    goto out;
    }
    +
    + if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) {
    + err = -EIO;
    + goto out;
    + }
    +
    hfs_bnode_read(fd.bnode, &entry, fd.entryoffset, fd.entrylength);
    type = be16_to_cpu(entry.type);
    len = HFSPLUS_MAX_STRLEN;
    --
    1.7.2.1.45.g54fbc




    \
     
     \ /
      Last update: 2012-10-02 02:01    [W:5.047 / U:0.976 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site