diff options
author | Linus Torvalds <torvalds@linux-foundation.org> | 2018-08-02 08:43:35 -0700 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2018-08-06 16:24:42 +0200 |
commit | 581c2941840f0a37aec39a3e8f4066fd86a8e61b (patch) | |
tree | 18d43d5e4d9fff69b667964c63027e54d2a86836 /drivers | |
parent | dac2939e629e092b9c65a6242f1b1c018e811dc8 (diff) |
squashfs: more metadata hardenings
commit 71755ee5350b63fb1f283de8561cdb61b47f4d1d upstream.
The squashfs fragment reading code doesn't actually verify that the
fragment is inside the fragment table. The end result _is_ verified to
be inside the image when actually reading the fragment data, but before
that is done, we may end up taking a page fault because the fragment
table itself might not even exist.
Another report from Anatoly and his endless squashfs image fuzzing.
Reported-by: Анатолий Тросиненко <anatoly.trosinenko@gmail.com>
Acked-by:: Phillip Lougher <phillip.lougher@gmail.com>,
Cc: Willy Tarreau <w@1wt.eu>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers')
0 files changed, 0 insertions, 0 deletions