adulau/aha
1
0
Fork 0
mirror of https://github.com/adulau/aha.git synced 2024-12-27 19:26:25 +00:00
Code Issues Projects Releases Packages Wiki Activity

Squashfs: Fix oops when reading fsfuzzer corrupted filesystems

Browse source 
This fixes a code regression caused by the recent mainlining changes.
The recent code changes call zlib_inflate repeatedly, decompressing into
separate 4K buffers, this code didn't check for the possibility that
zlib_inflate might ask for too many buffers when decompressing corrupted
data.

Signed-off-by: Phillip Lougher <phillip@lougher.demon.co.uk>
This commit is contained in:
Phillip Lougher 2009-03-05 00:31:12 +00:00
parent 2450cf51a1
commit 118e1ef6fa
4 changed files with 15 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
fs/squashfs/block.c
View file

@ -80,7 +80,7 @@ static struct buffer_head *get_block_length(struct super_block *sb,
* generated a larger block - this does occasionally happen with zlib). * generated a larger block - this does occasionally happen with zlib).
*/ */
int squashfs_read_data(struct super_block *sb, void **buffer, u64 index, int squashfs_read_data(struct super_block *sb, void **buffer, u64 index,
int length, u64 *next_index, int srclength) int length, u64 *next_index, int srclength, int pages)
{ {
struct squashfs_sb_info *msblk = sb->s_fs_info; struct squashfs_sb_info *msblk = sb->s_fs_info;
struct buffer_head **bh; struct buffer_head **bh;
@ -185,6 +185,14 @@ int squashfs_read_data(struct super_block *sb, void **buffer, u64 index,
} }
if (msblk->stream.avail_out == 0) { if (msblk->stream.avail_out == 0) {
if (page == pages) {
ERROR("zlib_inflate tried to "
"decompress too much data, "
"expected %d bytes. Zlib "
"data probably corrupt\n",
srclength);
goto release_mutex;
}
msblk->stream.next_out = buffer[page++]; msblk->stream.next_out = buffer[page++];
msblk->stream.avail_out = PAGE_CACHE_SIZE; msblk->stream.avail_out = PAGE_CACHE_SIZE;
} }
@ -268,7 +276,8 @@ block_release:
put_bh(bh[k]); put_bh(bh[k]);
read_failure: read_failure:
ERROR("sb_bread failed reading block 0x%llx\n", cur_index); ERROR("squashfs_read_data failed to read block 0x%llx\n",
(unsigned long long) index);
kfree(bh); kfree(bh);
return -EIO; return -EIO;
} }

4
fs/squashfs/cache.c
View file

@ -119,7 +119,7 @@ struct squashfs_cache_entry *squashfs_cache_get(struct super_block *sb,
entry->length = squashfs_read_data(sb, entry->data, entry->length = squashfs_read_data(sb, entry->data,
block, length, &entry->next_index, block, length, &entry->next_index,
cache->block_size); cache->block_size, cache->pages);
spin_lock(&cache->lock); spin_lock(&cache->lock);
@ -406,7 +406,7 @@ int squashfs_read_table(struct super_block *sb, void *buffer, u64 block,
for (i = 0; i < pages; i++, buffer += PAGE_CACHE_SIZE) for (i = 0; i < pages; i++, buffer += PAGE_CACHE_SIZE)
data[i] = buffer; data[i] = buffer;
res = squashfs_read_data(sb, data, block, length | res = squashfs_read_data(sb, data, block, length |
SQUASHFS_COMPRESSED_BIT_BLOCK, NULL, length); SQUASHFS_COMPRESSED_BIT_BLOCK, NULL, length, pages);
kfree(data); kfree(data);
return res; return res;
} }

2
fs/squashfs/squashfs.h
View file

@ -34,7 +34,7 @@ static inline struct squashfs_inode_info *squashfs_i(struct inode *inode)
/* block.c */ /* block.c */
extern int squashfs_read_data(struct super_block *, void **, u64, int, u64 *, extern int squashfs_read_data(struct super_block *, void **, u64, int, u64 *,
int); int, int);
/* cache.c */ /* cache.c */
extern struct squashfs_cache *squashfs_cache_init(char *, int, int); extern struct squashfs_cache *squashfs_cache_init(char *, int, int);

2
fs/squashfs/super.c
View file

@ -389,7 +389,7 @@ static int __init init_squashfs_fs(void)
return err; return err;
} }
printk(KERN_INFO "squashfs: version 4.0 (2009/01/03) " printk(KERN_INFO "squashfs: version 4.0 (2009/01/31) "
"Phillip Lougher\n"); "Phillip Lougher\n");
return 0; return 0;