ChangeSet 1.1982.161.34, 2005/03/25 17:46:03-08:00, [EMAIL PROTECTED]
[PATCH] isofs: more defensive checks against corrupt isofs images
Michal Zalewski <[EMAIL PROTECTED]> discovers range checking flaws in
iso9660 filesystem.
http://marc.theaimsgroup.com/?l=bugtraq&m=111110067304783&w=2
CAN-2005-0815 is assigned to this issue.
Some more defensive checks to keep corrupt isofs images from corrupting
memory or causing Oops.
Signed-off-by: Chris Wright <[EMAIL PROTECTED]>
===== fs/isofs/rock.c 1.23 vs edited =====
rock.c | 4 ++++
1 files changed, 4 insertions(+)
diff -Nru a/fs/isofs/rock.c b/fs/isofs/rock.c
--- a/fs/isofs/rock.c 2005-03-26 11:29:34 -08:00
+++ b/fs/isofs/rock.c 2005-03-26 11:29:34 -08:00
@@ -74,6 +74,10 @@
offset1 = 0; \
pbh = sb_bread(DEV->i_sb, block); \
if(pbh){ \
+ if (offset > pbh->b_size || offset + cont_size > pbh->b_size){ \
+ brelse(pbh); \
+ goto out; \
+ } \
memcpy(buffer + offset1, pbh->b_data + offset, cont_size - offset1); \
brelse(pbh); \
chr = (unsigned char *) buffer; \
-
To unsubscribe from this list: send the line "unsubscribe bk-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
