Squashfs: add corruption check for type in squashfs_readdir()

We read the type field from disk.  This value should be sanity
checked for correctness to avoid an out of bounds access when
reading the squashfs_filetype_table array.

Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>

1 files changed, 5 insertions, 2 deletions

diff --git a/fs/squashfs/dir.c b/fs/squashfs/dir.c
index bd7155b198a9..d8c2d747be28 100644
--- a/fs/squashfs/dir.c
+++ b/fs/squashfs/dir.c
@@ -112,8 +112,8 @@ static int squashfs_readdir(struct file *file, struct dir_context *ctx)
         struct inode *inode = file_inode(file);
         struct squashfs_sb_info *msblk = inode->i_sb->s_fs_info;
         u64 block = squashfs_i(inode)->start + msblk->directory_table;
-        int offset = squashfs_i(inode)->offset, length, type, err;
-        unsigned int inode_number, dir_count, size;
+        int offset = squashfs_i(inode)->offset, length, err;
+        unsigned int inode_number, dir_count, size, type;
         struct squashfs_dir_header dirh;
         struct squashfs_dir_entry *dire;
 
@@ -206,6 +206,9 @@ static int squashfs_readdir(struct file *file, struct dir_context *ctx)
                                 ((short) le16_to_cpu(dire->inode_number));
                         type = le16_to_cpu(dire->type);
 
+                        if (type > SQUASHFS_MAX_DIR_TYPE)
+                                goto failed_read;
+
                         if (!dir_emit(ctx, dire->name, size,
                                         inode_number,
                                         squashfs_filetype_table[type]))