| From e96a1866b40570b5950cda8602c2819189c62a48 Mon Sep 17 00:00:00 2001 |
| From: Jan Kara <jack@suse.cz> |
| Date: Mon, 18 Oct 2021 12:37:41 +0200 |
| Subject: isofs: Fix out of bound access for corrupted isofs image |
| |
| From: Jan Kara <jack@suse.cz> |
| |
| commit e96a1866b40570b5950cda8602c2819189c62a48 upstream. |
| |
| When isofs image is suitably corrupted isofs_read_inode() can read data |
| beyond the end of buffer. Sanity-check the directory entry length before |
| using it. |
| |
| Reported-and-tested-by: syzbot+6fc7fb214625d82af7d1@syzkaller.appspotmail.com |
| CC: stable@vger.kernel.org |
| Signed-off-by: Jan Kara <jack@suse.cz> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| fs/isofs/inode.c | 2 ++ |
| 1 file changed, 2 insertions(+) |
| |
| --- a/fs/isofs/inode.c |
| +++ b/fs/isofs/inode.c |
| @@ -1322,6 +1322,8 @@ static int isofs_read_inode(struct inode |
| |
| de = (struct iso_directory_record *) (bh->b_data + offset); |
| de_len = *(unsigned char *) de; |
| + if (de_len < sizeof(struct iso_directory_record)) |
| + goto fail; |
| |
| if (offset + de_len > bufsize) { |
| int frag1 = bufsize - offset; |
