diff options
| author | Jan Kara <jack@suse.cz> | 2026-07-27 13:43:17 +0200 |
|---|---|---|
| committer | Jan Kara <jack@suse.cz> | 2026-07-27 13:43:17 +0200 |
| commit | d10fa05027676941d7d75c85c17cde2133f72417 (patch) | |
| tree | 21e1d6cd11ce606642536b3ec805cd73018be441 | |
| parent | 9fdf954edc4783314931f150413dc8afae18754c (diff) | |
| parent | d95094d4c0a62ea17b8a7c6399b42381b8a55bc0 (diff) | |
| download | linux-next-d10fa05027676941d7d75c85c17cde2133f72417.tar.gz linux-next-d10fa05027676941d7d75c85c17cde2133f72417.zip | |
Pull udf unalloc space entry fixes.
| -rw-r--r-- | fs/udf/inode.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/fs/udf/inode.c b/fs/udf/inode.c index c97914aa8d8b..ee0cd402f3d8 100644 --- a/fs/udf/inode.c +++ b/fs/udf/inode.c @@ -1475,6 +1475,10 @@ reread: iinfo->i_lenAlloc = le32_to_cpu( ((struct unallocSpaceEntry *)bh->b_data)-> lengthAllocDescs); + if (iinfo->i_lenAlloc > bs - sizeof(struct unallocSpaceEntry)) { + ret = -EFSCORRUPTED; + goto out; + } ret = udf_alloc_i_data(inode, bs - sizeof(struct unallocSpaceEntry)); if (ret) @@ -1482,6 +1486,7 @@ reread: memcpy(iinfo->i_data, bh->b_data + sizeof(struct unallocSpaceEntry), bs - sizeof(struct unallocSpaceEntry)); + brelse(bh); return 0; } |