lkml.org 
[lkml]   [2001]   [Jan]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
SubjectRe: [reiserfs-list] major security bug in reiserfs (may affect SuSE Linux)


On Wednesday, January 10, 2001 02:32:09 AM +0100 Marc Lehmann <pcg@goof.com> wrote:
>>> EIP; c013f911 <filldir+20b/221> <=====
> Trace; c013f706 <filldir+0/221>
> Trace; c0136e01 <reiserfs_getblk+2a/16d>
>

Here is a patch against our 2.4 code (3.6.25) that does the
same as the patch posted for 3.5.29:

-chris

--- linux/include/linux/reiserfs_fs.h.1 Tue Jan 9 21:22:27 2001
+++ linux/include/linux/reiserfs_fs.h Tue Jan 9 21:22:55 2001
@@ -926,8 +926,7 @@
//((block_size - BLKH_SIZE - IH_SIZE - DEH_SIZE * 2) / 2)

// two entries per block (at least)
-#define REISERFS_MAX_NAME_LEN(block_size) \
-((block_size - BLKH_SIZE - IH_SIZE - DEH_SIZE))
+#define REISERFS_MAX_NAME_LEN(block_size) 255



--- linux/fs/reiserfs/dir.c.1 Tue Jan 9 21:22:19 2001
+++ linux/fs/reiserfs/dir.c Tue Jan 9 21:21:02 2001
@@ -142,6 +142,10 @@
if (!d_name[d_reclen - 1])
d_reclen = strlen (d_name);

+ if (d_reclen > REISERFS_MAX_NAME_LEN(inode->i_sb->s_blocksize)){
+ /* too big to send back to VFS */
+ continue ;
+ }
d_off = deh_offset (deh);
filp->f_pos = d_off ;
d_ino = deh_objectid (deh);

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:28    [W:0.088 / U:2.844 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site