---

yaml --- r: 5680 b: refs/heads/master c: fab5a60 h: refs/heads/master v: v3
git-mirror · Aug 6, 2005 · 3ff8aa7 · 3ff8aa7
1 parent e4c59d7
commit 3ff8aa7
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 1 deletion.
diff --git a/[refs] b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 243393c90f2b7cb781fd794e22786e9c8547901a
+refs/heads/master: fab5a60a29f98f17256a4183e34a414f6db67569
diff --git a/trunk/fs/isofs/compress.c b/trunk/fs/isofs/compress.c
@@ -129,8 +129,14 @@ static int zisofs_readpage(struct file *file, struct page *page)
 	cend = le32_to_cpu(*(__le32 *)(bh->b_data + (blockendptr & bufmask)));
 	brelse(bh);
 
+	if (cstart > cend)
+		goto eio;
+
 	csize = cend-cstart;
 
+	if (csize > deflateBound(1UL << zisofs_block_shift))
+		goto eio;
+
 	/* Now page[] contains an array of pages, any of which can be NULL,
 	   and the locks on which we hold.  We should now read the data and
 	   release the pages.  If the pages are NULL the decompressed data