diff options
| author | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2012-05-10 16:58:51 -0700 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2012-05-10 16:58:51 -0700 |
| commit | 8a77a893e321c1fff214a542840be4f9ac03627b (patch) | |
| tree | aea4b6e5817610e20bbf4b1ccd8c9fe7c0295309 /hfsplus-bugfixes.patch | |
| parent | ccffb30ab2ec6e5b0ae3aaf1d0f77d3bf3c9527a (diff) | |
| download | patches-8a77a893e321c1fff214a542840be4f9ac03627b.tar.gz | |
more patches
Diffstat (limited to 'hfsplus-bugfixes.patch')
| -rw-r--r-- | hfsplus-bugfixes.patch | 73 |
1 files changed, 73 insertions, 0 deletions
diff --git a/hfsplus-bugfixes.patch b/hfsplus-bugfixes.patch new file mode 100644 index 00000000000000..6675e2acc37da9 --- /dev/null +++ b/hfsplus-bugfixes.patch @@ -0,0 +1,73 @@ +From foo@baz Fri May 4 12:02:41 PDT 2012 +Date: Fri, 04 May 2012 12:02:41 -0700 +To: Greg KH <gregkh@linuxfoundation.org> +From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +Subject: [PATCH] hfsplus: Fix potential buffer overflows + +commit ec81aecb29668ad71f699f4e7b96ec46691895b6 (hfs: fix a potential +buffer overflow) fixed a few potential buffer overflows in the hfs +filesystem. But as Timo Warns pointed out, these changes also need to +be made on the hfsplus filesystem as well. + +Reported-by: Timo Warns <warns@pre-sense.de> +Signed-off-by: WANG Cong <amwang@redhat.com> +Cc: Alexey Khoroshilov <khoroshilov@ispras.ru> +Cc: Cong Wang <amwang@redhat.com> +Cc: Miklos Szeredi <mszeredi@suse.cz> +Cc: Sage Weil <sage@newdream.net> +Cc: Eugene Teo <eteo@redhat.com> +Cc: Roman Zippel <zippel@linux-m68k.org> +Cc: Al Viro <viro@zeniv.linux.org.uk> +Cc: Christoph Hellwig <hch@lst.de> +Cc: Alexey Dobriyan <adobriyan@gmail.com> +Cc: Dave Anderson <anderson@redhat.com> +Cc: stable <stable@vger.kernel.org> +Cc: Andrew Morton <akpm@linux-foundation.org> +Cc: Linus Torvalds <torvalds@linux-foundation.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> + +--- + fs/hfsplus/catalog.c | 4 ++++ + fs/hfsplus/dir.c | 11 +++++++++++ + 2 files changed, 15 insertions(+) + +--- a/fs/hfsplus/catalog.c ++++ b/fs/hfsplus/catalog.c +@@ -366,6 +366,10 @@ int hfsplus_rename_cat(u32 cnid, + err = hfs_brec_find(&src_fd); + if (err) + goto out; ++ if (src_fd.entrylength > sizeof(entry) || src_fd.entrylength < 0) { ++ err = -EIO; ++ goto out; ++ } + + hfs_bnode_read(src_fd.bnode, &entry, src_fd.entryoffset, + src_fd.entrylength); +--- a/fs/hfsplus/dir.c ++++ b/fs/hfsplus/dir.c +@@ -150,6 +150,11 @@ static int hfsplus_readdir(struct file * + filp->f_pos++; + /* fall through */ + case 1: ++ if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) { ++ err = -EIO; ++ goto out; ++ } ++ + hfs_bnode_read(fd.bnode, &entry, fd.entryoffset, + fd.entrylength); + if (be16_to_cpu(entry.type) != HFSPLUS_FOLDER_THREAD) { +@@ -181,6 +186,12 @@ static int hfsplus_readdir(struct file * + err = -EIO; + goto out; + } ++ ++ if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) { ++ err = -EIO; ++ goto out; ++ } ++ + hfs_bnode_read(fd.bnode, &entry, fd.entryoffset, + fd.entrylength); + type = be16_to_cpu(entry.type); |