| From bc5b8a9003132ae44559edd63a1623b7b99dfb68 Mon Sep 17 00:00:00 2001 |
| From: Dan Carpenter <dan.carpenter@oracle.com> |
| Date: Mon, 14 Nov 2011 17:52:08 +0300 |
| Subject: hfs: add sanity check for file name length |
| |
| From: Dan Carpenter <dan.carpenter@oracle.com> |
| |
| commit bc5b8a9003132ae44559edd63a1623b7b99dfb68 upstream. |
| |
| On a corrupted file system the ->len field could be wrong leading to |
| a buffer overflow. |
| |
| Reported-and-acked-by: Clement LECIGNE <clement.lecigne@netasq.com> |
| Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> |
| Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> |
| |
| --- |
| fs/hfs/trans.c | 2 ++ |
| 1 file changed, 2 insertions(+) |
| |
| --- a/fs/hfs/trans.c |
| +++ b/fs/hfs/trans.c |
| @@ -40,6 +40,8 @@ int hfs_mac2asc(struct super_block *sb, |
| |
| src = in->name; |
| srclen = in->len; |
| + if (srclen > HFS_NAMELEN) |
| + srclen = HFS_NAMELEN; |
| dst = out; |
| dstlen = HFS_MAX_NAMELEN; |
| if (nls_io) { |
