diff options
| author | Mark Brown <broonie@opensource.wolfsonmicro.com> | 2012-05-13 13:32:54 +0100 |
|---|---|---|
| committer | Mark Brown <broonie@opensource.wolfsonmicro.com> | 2012-05-13 13:32:54 +0100 |
| commit | dc2af52c0d6d00fd530e4a5e300834cdb1bb1c1c (patch) | |
| tree | 4573b99fb11e5b93bd011045039b370ddafe45e6 /fs/hfsplus/dir.c | |
| parent | f1992dde7fef6713a469a5a142b86812b8a47f9e (diff) | |
| parent | 36be50515fe2aef61533b516fa2576a2c7fe7664 (diff) | |
Merge tag 'v3.4-rc7' into for-3.5
Linux 3.4-rc7
Conflicts):
drivers/base/regmap/regmap.c (overlap with bug fixes)
sound/soc/blackfin/bf5xx-ssm2602.c (overlap with bug fixes)
Diffstat (limited to 'fs/hfsplus/dir.c')
| -rw-r--r-- | fs/hfsplus/dir.c | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/fs/hfsplus/dir.c b/fs/hfsplus/dir.c index 88e155f895c6..26b53fb09f68 100644 --- a/fs/hfsplus/dir.c +++ b/fs/hfsplus/dir.c @@ -150,6 +150,11 @@ static int hfsplus_readdir(struct file *filp, void *dirent, filldir_t filldir) filp->f_pos++; /* fall through */ case 1: + if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) { + err = -EIO; + goto out; + } + hfs_bnode_read(fd.bnode, &entry, fd.entryoffset, fd.entrylength); if (be16_to_cpu(entry.type) != HFSPLUS_FOLDER_THREAD) { @@ -181,6 +186,12 @@ static int hfsplus_readdir(struct file *filp, void *dirent, filldir_t filldir) err = -EIO; goto out; } + + if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) { + err = -EIO; + goto out; + } + hfs_bnode_read(fd.bnode, &entry, fd.entryoffset, fd.entrylength); type = be16_to_cpu(entry.type); |