From 58b5ad1eeba9f997da03fef066042382682df932 Mon Sep 17 00:00:00 2001 From: Xi Wang Date: Wed, 25 Apr 2012 14:45:22 -0400 Subject: [PATCH] --- yaml --- r: 310201 b: refs/heads/master c: 7c80c352331a27cf0584f1701ed3a003984985f0 h: refs/heads/master i: 310199: bd1497a7eb10c589f496711bc16dc9cf98fffe0f v: v3 --- [refs] | 2 +- trunk/fs/jffs2/readinode.c | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/[refs] b/[refs] index 7f3724f21f74..a0573d52beb0 100644 --- a/[refs] +++ b/[refs] @@ -1,2 +1,2 @@ --- -refs/heads/master: 8abc0d4a1181b44e0a42cadab4a15f8c6aa42451 +refs/heads/master: 7c80c352331a27cf0584f1701ed3a003984985f0 diff --git a/trunk/fs/jffs2/readinode.c b/trunk/fs/jffs2/readinode.c index dc0437e84763..9897f38af707 100644 --- a/trunk/fs/jffs2/readinode.c +++ b/trunk/fs/jffs2/readinode.c @@ -1266,6 +1266,12 @@ static int jffs2_do_read_inode_internal(struct jffs2_sb_info *c, /* Symlink's inode data is the target path. Read it and * keep in RAM to facilitate quick follow symlink * operation. */ + uint32_t csize = je32_to_cpu(latest_node->csize); + if (csize > JFFS2_MAX_NAME_LEN) { + mutex_unlock(&f->sem); + jffs2_do_clear_inode(c, f); + return -ENAMETOOLONG; + } f->target = kmalloc(je32_to_cpu(latest_node->csize) + 1, GFP_KERNEL); if (!f->target) { JFFS2_ERROR("can't allocate %d bytes of memory for the symlink target path cache\n", je32_to_cpu(latest_node->csize));