udf: validate VAT inode size for old VAT format Validate VAT inode is large enough to contain at least the header for pre-2.00 UDF media format. Signed-off-by: Jan Kara <jack@suse.cz>
diff --git a/fs/udf/super.c b/fs/udf/super.c index 1b52827..c7110d2 100644 --- a/fs/udf/super.c +++ b/fs/udf/super.c
@@ -1242,6 +1242,11 @@ static int udf_load_vat(struct super_block *sb, int p_index, int type1_index) if (map->s_partition_type == UDF_VIRTUAL_MAP15) { map->s_type_specific.s_virtual.s_start_offset = 0; + if (sbi->s_vat_inode->i_size < 36) { + udf_err(sb, "Too short VAT inode size %lld\n", + sbi->s_vat_inode->i_size); + return -EFSCORRUPTED; + } map->s_type_specific.s_virtual.s_num_entries = (sbi->s_vat_inode->i_size - 36) >> 2; } else if (map->s_partition_type == UDF_VIRTUAL_MAP20) {