A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-28 18:51:56 -04:00
Code Issues Projects Releases Packages Wiki Activity

squashfs: more metadata hardening

Browse source 
Anatoly reports another squashfs fuzzing issue, where the decompression
parameters themselves are in a compressed block.

This causes squashfs_read_data() to be called in order to read the
decompression options before the decompression stream having been set
up, making squashfs go sideways.

Reported-by: Anatoly Trosinenko <[email protected]>
Acked-by: Phillip Lougher <[email protected]>
Cc: [email protected]
Signed-off-by: Linus Torvalds <[email protected]>
This commit is contained in:
Linus Torvalds 2018-07-30 14:27:15 -07:00
commit d512584780
1 changed files with 2 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2
fs/squashfs/block.c
View file

@ -167,6 +167,8 @@ int squashfs_read_data(struct super_block *sb, u64 index, int length,
}
if (compressed) {
if (!msblk->stream)
goto read_failure;
length = squashfs_decompress(msblk, bh, b, offset, length,
output);
if (length < 0)