summaryrefslogtreecommitdiffstats
path: root/fs/hfsplus/dir.c
diff options
context:
space:
mode:
authorDavid S. Miller <davem@davemloft.net>2012-05-16 22:17:37 -0400
committerDavid S. Miller <davem@davemloft.net>2012-05-16 22:17:37 -0400
commit028940342a906db8da014a7603a0deddc2c323dd (patch)
tree688dbc38a3e218f2493d311b1d70a67668837347 /fs/hfsplus/dir.c
parentbe3eed2e96340d3c7a4d1ea1d63e7bd6095d1e34 (diff)
parent0e93b4b304ae052ba1bc73f6d34a68556fe93429 (diff)
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Diffstat (limited to 'fs/hfsplus/dir.c')
-rw-r--r--fs/hfsplus/dir.c11
1 files changed, 11 insertions, 0 deletions
diff --git a/fs/hfsplus/dir.c b/fs/hfsplus/dir.c
index 88e155f895c..26b53fb09f6 100644
--- a/fs/hfsplus/dir.c
+++ b/fs/hfsplus/dir.c
@@ -150,6 +150,11 @@ static int hfsplus_readdir(struct file *filp, void *dirent, filldir_t filldir)
filp->f_pos++;
/* fall through */
case 1:
+ if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) {
+ err = -EIO;
+ goto out;
+ }
+
hfs_bnode_read(fd.bnode, &entry, fd.entryoffset,
fd.entrylength);
if (be16_to_cpu(entry.type) != HFSPLUS_FOLDER_THREAD) {
@@ -181,6 +186,12 @@ static int hfsplus_readdir(struct file *filp, void *dirent, filldir_t filldir)
err = -EIO;
goto out;
}
+
+ if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) {
+ err = -EIO;
+ goto out;
+ }
+
hfs_bnode_read(fd.bnode, &entry, fd.entryoffset,
fd.entrylength);
type = be16_to_cpu(entry.type);