| From 9e8cc7f0f72e3b41734ae4a91350282996f1008d Mon Sep 17 00:00:00 2001 |
| From: Timo Warns <Warns@pre-sense.de> |
| Date: Wed, 17 Aug 2011 17:59:56 +0200 |
| Subject: [PATCH] befs: Validate length of long symbolic links. |
| |
| commit 338d0f0a6fbc82407864606f5b64b75aeb3c70f2 upstream. |
| |
| Signed-off-by: Timo Warns <warns@pre-sense.de> |
| Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| |
| diff --git a/fs/befs/linuxvfs.c b/fs/befs/linuxvfs.c |
| index 34ddda8..9158c07 100644 |
| --- a/fs/befs/linuxvfs.c |
| +++ b/fs/befs/linuxvfs.c |
| @@ -469,17 +469,22 @@ befs_follow_link(struct dentry *dentry, struct nameidata *nd) |
| befs_data_stream *data = &befs_ino->i_data.ds; |
| befs_off_t len = data->size; |
| |
| - befs_debug(sb, "Follow long symlink"); |
| - |
| - link = kmalloc(len, GFP_NOFS); |
| - if (!link) { |
| - link = ERR_PTR(-ENOMEM); |
| - } else if (befs_read_lsymlink(sb, data, link, len) != len) { |
| - kfree(link); |
| - befs_error(sb, "Failed to read entire long symlink"); |
| + if (len == 0) { |
| + befs_error(sb, "Long symlink with illegal length"); |
| link = ERR_PTR(-EIO); |
| } else { |
| - link[len - 1] = '\0'; |
| + befs_debug(sb, "Follow long symlink"); |
| + |
| + link = kmalloc(len, GFP_NOFS); |
| + if (!link) { |
| + link = ERR_PTR(-ENOMEM); |
| + } else if (befs_read_lsymlink(sb, data, link, len) != len) { |
| + kfree(link); |
| + befs_error(sb, "Failed to read entire long symlink"); |
| + link = ERR_PTR(-EIO); |
| + } else { |
| + link[len - 1] = '\0'; |
| + } |
| } |
| } else { |
| link = befs_ino->i_data.symlink; |
| -- |
| 1.7.7 |
| |
