udf: Check length of extended attributes and allocation descriptors
authorJan Kara <jack@suse.cz>
Wed, 7 Jan 2015 12:49:08 +0000 (13:49 +0100)
committerJan Kara <jack@suse.cz>
Wed, 7 Jan 2015 12:51:58 +0000 (13:51 +0100)
Check length of extended attributes and allocation descriptors when
loading inodes from disk. Otherwise corrupted filesystems could confuse
the code and make the kernel oops.

Reported-by: Carl Henrik Lunde <chlunde@ping.uio.no>
CC: stable@vger.kernel.org
Signed-off-by: Jan Kara <jack@suse.cz>
fs/udf/inode.c

index 95cb6970c3eafc87bbe1d10a66481315e3bd3241..7b72b7dd8906b8b6c6e6b1d848f881969630b839 100644 (file)
@@ -1487,6 +1487,15 @@ reread:
        }
        inode->i_generation = iinfo->i_unique;
 
+       /*
+        * Sanity check length of allocation descriptors and extended attrs to
+        * avoid integer overflows
+        */
+       if (iinfo->i_lenEAttr > bs || iinfo->i_lenAlloc > bs)
+               goto out;
+       /* Now do exact checks */
+       if (udf_file_entry_alloc_offset(inode) + iinfo->i_lenAlloc > bs)
+               goto out;
        /* Sanity checks for files in ICB so that we don't get confused later */
        if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) {
                /*