diff options
-rw-r--r-- | fs/squashfs/dir.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/fs/squashfs/dir.c b/fs/squashfs/dir.c index 119208422260..bd7155b198a9 100644 --- a/fs/squashfs/dir.c +++ b/fs/squashfs/dir.c | |||
@@ -54,6 +54,7 @@ static int get_dir_index_using_offset(struct super_block *sb, | |||
54 | { | 54 | { |
55 | struct squashfs_sb_info *msblk = sb->s_fs_info; | 55 | struct squashfs_sb_info *msblk = sb->s_fs_info; |
56 | int err, i, index, length = 0; | 56 | int err, i, index, length = 0; |
57 | unsigned int size; | ||
57 | struct squashfs_dir_index dir_index; | 58 | struct squashfs_dir_index dir_index; |
58 | 59 | ||
59 | TRACE("Entered get_dir_index_using_offset, i_count %d, f_pos %lld\n", | 60 | TRACE("Entered get_dir_index_using_offset, i_count %d, f_pos %lld\n", |
@@ -81,8 +82,14 @@ static int get_dir_index_using_offset(struct super_block *sb, | |||
81 | */ | 82 | */ |
82 | break; | 83 | break; |
83 | 84 | ||
85 | size = le32_to_cpu(dir_index.size) + 1; | ||
86 | |||
87 | /* size should never be larger than SQUASHFS_NAME_LEN */ | ||
88 | if (size > SQUASHFS_NAME_LEN) | ||
89 | break; | ||
90 | |||
84 | err = squashfs_read_metadata(sb, NULL, &index_start, | 91 | err = squashfs_read_metadata(sb, NULL, &index_start, |
85 | &index_offset, le32_to_cpu(dir_index.size) + 1); | 92 | &index_offset, size); |
86 | if (err < 0) | 93 | if (err < 0) |
87 | break; | 94 | break; |
88 | 95 | ||