aboutsummaryrefslogtreecommitdiff
path: root/lib
diff options
context:
space:
mode:
authorDavid Oberhollenzer <david.oberhollenzer@sigma-star.at>2019-08-23 13:25:14 +0200
committerDavid Oberhollenzer <david.oberhollenzer@sigma-star.at>2019-08-23 13:44:13 +0200
commite31c0fcd809a649b70e6bab08a8b89f9ced07510 (patch)
tree0bfd2dbe224d8eef9c7e5784eb88533a1b8ca414 /lib
parenta38b1cbc5e917d945340a6dd9dba4274a2eb8789 (diff)
Check against format limits in meta_reader_read_dir_header
The SquashFS kernel implementation insists that a directory header is followed by no more than an upper bound of entries, way less than what the filed itself actually supports. This commit makes sure that the meta_reader_read_dir_header function also enforces that same limit. Signed-off-by: David Oberhollenzer <david.oberhollenzer@sigma-star.at>
Diffstat (limited to 'lib')
-rw-r--r--lib/sqfs/readdir.c7
1 files changed, 7 insertions, 0 deletions
diff --git a/lib/sqfs/readdir.c b/lib/sqfs/readdir.c
index 598ccc2..d67d264 100644
--- a/lib/sqfs/readdir.c
+++ b/lib/sqfs/readdir.c
@@ -20,6 +20,13 @@ int meta_reader_read_dir_header(meta_reader_t *m, sqfs_dir_header_t *hdr)
hdr->count = le32toh(hdr->count);
hdr->start_block = le32toh(hdr->start_block);
hdr->inode_number = le32toh(hdr->inode_number);
+
+ if (hdr->count > (SQFS_MAX_DIR_ENT - 1)) {
+ fputs("Found a directory header with too many entries\n",
+ stderr);
+ return -1;
+ }
+
return 0;
}