ich777/linux_media
1
0
Fork 0
mirror of https://github.com/tbsdtv/linux_media.git synced 2025-07-23 20:51:03 +02:00
Code Issues Packages Projects Releases Wiki Activity

udf: Limit sparing table size

Browse Source 
Although UDF standard allows it, we don't support sparing table larger
than a single block. Check it during mount so that we don't try to
access memory beyond end of buffer.

Reported-by: syzbot+9991561e714f597095da@syzkaller.appspotmail.com
Signed-off-by: Jan Kara <jack@suse.cz>
This commit is contained in:
Jan Kara
2020-09-25 14:53:08 +02:00
parent 382a2287bf
commit 44ac6b829c
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
fs/udf/super.c
View File

@@ -1345,6 +1345,12 @@ static int udf_load_sparable_map(struct super_block *sb,
(int)spm->numSparingTables); (int)spm->numSparingTables);
return -EIO; return -EIO;
} }
if (le32_to_cpu(spm->sizeSparingTable) > sb->s_blocksize) {
udf_err(sb, "error loading logical volume descriptor: "
"Too big sparing table size (%u)\n",
le32_to_cpu(spm->sizeSparingTable));
return -EIO;
}
for (i = 0; i < spm->numSparingTables; i++) { for (i = 0; i < spm->numSparingTables; i++) {
loc = le32_to_cpu(spm->locSparingTable[i]); loc = le32_to_cpu(spm->locSparingTable[i]);