diff options
Diffstat (limited to 'fs/hfs/dir.c')
-rw-r--r-- | fs/hfs/dir.c | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/fs/hfs/dir.c b/fs/hfs/dir.c index 7c69b98a2e45..2b3b8611b41b 100644 --- a/fs/hfs/dir.c +++ b/fs/hfs/dir.c | |||
@@ -79,6 +79,11 @@ static int hfs_readdir(struct file *filp, void *dirent, filldir_t filldir) | |||
79 | filp->f_pos++; | 79 | filp->f_pos++; |
80 | /* fall through */ | 80 | /* fall through */ |
81 | case 1: | 81 | case 1: |
82 | if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) { | ||
83 | err = -EIO; | ||
84 | goto out; | ||
85 | } | ||
86 | |||
82 | hfs_bnode_read(fd.bnode, &entry, fd.entryoffset, fd.entrylength); | 87 | hfs_bnode_read(fd.bnode, &entry, fd.entryoffset, fd.entrylength); |
83 | if (entry.type != HFS_CDR_THD) { | 88 | if (entry.type != HFS_CDR_THD) { |
84 | printk(KERN_ERR "hfs: bad catalog folder thread\n"); | 89 | printk(KERN_ERR "hfs: bad catalog folder thread\n"); |
@@ -109,6 +114,12 @@ static int hfs_readdir(struct file *filp, void *dirent, filldir_t filldir) | |||
109 | err = -EIO; | 114 | err = -EIO; |
110 | goto out; | 115 | goto out; |
111 | } | 116 | } |
117 | |||
118 | if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) { | ||
119 | err = -EIO; | ||
120 | goto out; | ||
121 | } | ||
122 | |||
112 | hfs_bnode_read(fd.bnode, &entry, fd.entryoffset, fd.entrylength); | 123 | hfs_bnode_read(fd.bnode, &entry, fd.entryoffset, fd.entrylength); |
113 | type = entry.type; | 124 | type = entry.type; |
114 | len = hfs_mac2asc(sb, strbuf, &fd.key->cat.CName); | 125 | len = hfs_mac2asc(sb, strbuf, &fd.key->cat.CName); |