---

yaml --- r: 310201 b: refs/heads/master c: 7c80c35 h: refs/heads/master i: 310199: bd1497a v: v3
git-mirror · May 14, 2012 · 58b5ad1 · 58b5ad1
1 parent 80e5cb0
commit 58b5ad1
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 1 deletion.
diff --git a/[refs] b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 8abc0d4a1181b44e0a42cadab4a15f8c6aa42451
+refs/heads/master: 7c80c352331a27cf0584f1701ed3a003984985f0
diff --git a/trunk/fs/jffs2/readinode.c b/trunk/fs/jffs2/readinode.c
@@ -1266,6 +1266,12 @@ static int jffs2_do_read_inode_internal(struct jffs2_sb_info *c,
 			/* Symlink's inode data is the target path. Read it and
 			 * keep in RAM to facilitate quick follow symlink
 			 * operation. */
+			uint32_t csize = je32_to_cpu(latest_node->csize);
+			if (csize > JFFS2_MAX_NAME_LEN) {
+				mutex_unlock(&f->sem);
+				jffs2_do_clear_inode(c, f);
+				return -ENAMETOOLONG;
+			}
 			f->target = kmalloc(je32_to_cpu(latest_node->csize) + 1, GFP_KERNEL);
 			if (!f->target) {
 				JFFS2_ERROR("can't allocate %d bytes of memory for the symlink target path cache\n", je32_to_cpu(latest_node->csize));