forked from Minki/linux
a48fc69fe6
udf_readdir() didn't validate the directory position it should start reading from. Thus when user uses lseek(2) on directory file descriptor it can trick udf_readdir() into reading from a position in the middle of directory entry which then upsets directory parsing code resulting in errors or even possible kernel crashes. Similarly when the directory is modified between two readdir calls, the directory position need not be valid anymore. Add code to validate current offset in the directory. This is actually rather expensive for UDF as we need to read from the beginning of the directory and parse all directory entries. This is because in UDF a directory is just a stream of data containing directory entries and since file names are fully under user's control we cannot depend on detecting magic numbers and checksums in the header of directory entry as a malicious attacker could fake them. We skip this step if we detect that nothing changed since the last readdir call. Reported-by: Nathan Wilson <nate@chickenbrittle.com> CC: stable@vger.kernel.org Signed-off-by: Jan Kara <jack@suse.cz> |
||
|---|---|---|
| .. | ||
| balloc.c | ||
| dir.c | ||
| directory.c | ||
| ecma_167.h | ||
| file.c | ||
| ialloc.c | ||
| inode.c | ||
| Kconfig | ||
| lowlevel.c | ||
| Makefile | ||
| misc.c | ||
| namei.c | ||
| osta_udf.h | ||
| partition.c | ||
| super.c | ||
| symlink.c | ||
| truncate.c | ||
| udf_i.h | ||
| udf_sb.h | ||
| udfdecl.h | ||
| udfend.h | ||
| udftime.c | ||
| unicode.c | ||