lkml.org 
[lkml]   [2013]   [Jul]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[patch] Squashfs: sanity check information from disk
We read the size of the name from the disk, but a larger name than
expected would cause memory corruption.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
I don't know this code very well, but to me it looks like there is an
off by one bug here as well.

We say:

size = le32_to_cpu(index->size) + 1;

The "+ 1" is presumably for the NUL terminator. Then we do:

index->name[size] = '\0';

That means we are putting a NUL character one space beyond the end of
the array. Presumably the first character of the next thing saved to
the disk is usually zero so that's why we don't notice that we are
reading a extra character when we read "size" number of bytes.

diff --git a/fs/squashfs/namei.c b/fs/squashfs/namei.c
index 7834a51..bc1334c 100644
--- a/fs/squashfs/namei.c
+++ b/fs/squashfs/namei.c
@@ -79,7 +79,8 @@ static int get_dir_index_using_name(struct super_block *sb,
int len)
{
struct squashfs_sb_info *msblk = sb->s_fs_info;
- int i, size, length = 0, err;
+ int i, length = 0, err;
+ unsigned int size;
struct squashfs_dir_index *index;
char *str;

@@ -103,6 +104,10 @@ static int get_dir_index_using_name(struct super_block *sb,


size = le32_to_cpu(index->size) + 1;
+ if (size >= SQUASHFS_NAME_LEN + 1) {
+ err = -EINVAL;
+ break;
+ }

err = squashfs_read_metadata(sb, index->name, &index_start,
&index_offset, size);

\
 
 \ /
  Last update: 2013-07-15 19:01    [W:0.055 / U:0.240 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site