tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
fork atom

Check input buffer size in zisofs

This uses the new deflateBound() thing to sanity-check the input to the
zlib decompressor before we even bother to start reading in the blocks.

Problem noted by Tim Yamin <plasmaroo@gentoo.org>

Linus Torvalds fab5a60a 243393c9

+6
unified split
+6
fs/isofs/compress.c
··· 129 cend = le32_to_cpu(*(__le32 *)(bh->b_data + (blockendptr & bufmask))); 130 brelse(bh); 131 132 csize = cend-cstart; 133 134 /* Now page[] contains an array of pages, any of which can be NULL, 135 and the locks on which we hold. We should now read the data and
··· 129 cend = le32_to_cpu(*(__le32 *)(bh->b_data + (blockendptr & bufmask))); 130 brelse(bh); 131 132 + if (cstart > cend) 133 + goto eio; 134 + 135 csize = cend-cstart; 136 + 137 + if (csize > deflateBound(1UL << zisofs_block_shift)) 138 + goto eio; 139 140 /* Now page[] contains an array of pages, any of which can be NULL, 141 and the locks on which we hold. We should now read the data and