summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorPhillip Lougher <phillip@lougher.demon.co.uk>2010-04-23 02:32:02 +0100
committerPhillip Lougher <phillip@lougher.demon.co.uk>2010-04-25 02:09:05 +0100
commite0d1f70010dce062ccce1bbd940a661e60b82631 (patch)
tree1a0844867f6aa1600a07a8a5321325ddf016a6e6
parent370ec3d1ed9d76ba992e5b9b7d7d10700014d436 (diff)
squashfs: fix potential buffer over-run on 4K block file systems
Sizing the buffer based on block size is incorrect, leading to a potential buffer over-run on 4K block size file systems (because the metadata block size is always 8K). This bug doesn't seem have triggered because 4K block size file systems are not default, and also because metadata blocks after compression tend to be less than 4K. Signed-off-by: Phillip Lougher <phillip@lougher.demon.co.uk>
-rw-r--r--fs/squashfs/block.c5
1 files changed, 2 insertions, 3 deletions
diff --git a/fs/squashfs/block.c b/fs/squashfs/block.c
index 1cb0d81b164..653c030eb84 100644
--- a/fs/squashfs/block.c
+++ b/fs/squashfs/block.c
@@ -87,9 +87,8 @@ int squashfs_read_data(struct super_block *sb, void **buffer, u64 index,
u64 cur_index = index >> msblk->devblksize_log2;
int bytes, compressed, b = 0, k = 0, page = 0, avail;
-
- bh = kcalloc((msblk->block_size >> msblk->devblksize_log2) + 1,
- sizeof(*bh), GFP_KERNEL);
+ bh = kcalloc(((srclength + msblk->devblksize - 1)
+ >> msblk->devblksize_log2) + 1, sizeof(*bh), GFP_KERNEL);
if (bh == NULL)
return -ENOMEM;