Squashfs: fix corruption checks in squashfs_readdir()

The dir_count and size fields when read from disk are sanity
checked for correctness.  However, the sanity checks only check the
values are not greater than expected.  As dir_count and size were
incorrectly defined as signed ints, this can lead to corrupted values
appearing as negative which are not trapped.

Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>

diff --git a/fs/squashfs/dir.c b/fs/squashfs/dir.c
index f7f527bf8c10f9f5271e4788c7d1e3ec8e80fd4b..11920842226011f1e4e67b7c927ac418fc3ec730 100644 (file)
--- a/fs/squashfs/dir.c
+++ b/fs/squashfs/dir.c
@@ -105,9 +105,8 @@ static int squashfs_readdir(struct file *file, struct dir_context *ctx)
        struct inode *inode = file_inode(file);
        struct squashfs_sb_info *msblk = inode->i_sb->s_fs_info;
        u64 block = squashfs_i(inode)->start + msblk->directory_table;
-       int offset = squashfs_i(inode)->offset, length, dir_count, size,
-                               type, err;
-       unsigned int inode_number;
+       int offset = squashfs_i(inode)->offset, length, type, err;
+       unsigned int inode_number, dir_count, size;
        struct squashfs_dir_header dirh;
        struct squashfs_dir_entry *dire;