From patchwork Thu May 24 03:21:56 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Subject: [1/1, HARDY, XEN, HARDY, OPENVZ, CVE-2012-2319] hfsplus: Fix potential buffer overflows Date: Wed, 23 May 2012 17:21:56 -0000 From: Brad Figg X-Patchwork-Id: 161058 Message-Id: <1337829716-17315-2-git-send-email-brad.figg@canonical.com> To: kernel-team@lists.ubuntu.com CVE-2012-2319 Commit ec81aecb2966 ("hfs: fix a potential buffer overflow") fixed a few potential buffer overflows in the hfs filesystem. But as Timo Warns pointed out, these changes also need to be made on the hfsplus filesystem as well. Reported-by: Timo Warns Acked-by: WANG Cong Cc: Alexey Khoroshilov Cc: Miklos Szeredi Cc: Sage Weil Cc: Eugene Teo Cc: Roman Zippel Cc: Al Viro Cc: Christoph Hellwig Cc: Alexey Dobriyan Cc: Dave Anderson Cc: stable Cc: Andrew Morton Signed-off-by: Greg Kroah-Hartman Signed-off-by: Linus Torvalds (backported from commit 6f24f892871acc47b40dd594c63606a17c714f77 upstream) Signed-off-by: Brad Figg --- .../openvz/src/fs/hfsplus/catalog.c | 4 ++++ debian/binary-custom.d/openvz/src/fs/hfsplus/dir.c | 11 +++++++++++ .../binary-custom.d/xen/src/fs/hfsplus/catalog.c | 4 ++++ debian/binary-custom.d/xen/src/fs/hfsplus/dir.c | 11 +++++++++++ 4 files changed, 30 insertions(+) diff --git a/debian/binary-custom.d/openvz/src/fs/hfsplus/catalog.c b/debian/binary-custom.d/openvz/src/fs/hfsplus/catalog.c index f6874ac..8a7cbcf 100644 --- a/debian/binary-custom.d/openvz/src/fs/hfsplus/catalog.c +++ b/debian/binary-custom.d/openvz/src/fs/hfsplus/catalog.c @@ -329,6 +329,10 @@ int hfsplus_rename_cat(u32 cnid, err = hfs_brec_find(&src_fd); if (err) goto out; + if (src_fd.entrylength > sizeof(entry) || src_fd.entrylength < 0) { + err = -EIO; + goto out; + } hfs_bnode_read(src_fd.bnode, &entry, src_fd.entryoffset, src_fd.entrylength); diff --git a/debian/binary-custom.d/openvz/src/fs/hfsplus/dir.c b/debian/binary-custom.d/openvz/src/fs/hfsplus/dir.c index 078684f..2d57b2b 100644 --- a/debian/binary-custom.d/openvz/src/fs/hfsplus/dir.c +++ b/debian/binary-custom.d/openvz/src/fs/hfsplus/dir.c @@ -138,6 +138,11 @@ static int hfsplus_readdir(struct file *filp, void *dirent, filldir_t filldir) filp->f_pos++; /* fall through */ case 1: + if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) { + err = -EIO; + goto out; + } + hfs_bnode_read(fd.bnode, &entry, fd.entryoffset, fd.entrylength); if (be16_to_cpu(entry.type) != HFSPLUS_FOLDER_THREAD) { printk(KERN_ERR "hfs: bad catalog folder thread\n"); @@ -168,6 +173,12 @@ static int hfsplus_readdir(struct file *filp, void *dirent, filldir_t filldir) err = -EIO; goto out; } + + if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) { + err = -EIO; + goto out; + } + hfs_bnode_read(fd.bnode, &entry, fd.entryoffset, fd.entrylength); type = be16_to_cpu(entry.type); len = HFSPLUS_MAX_STRLEN; diff --git a/debian/binary-custom.d/xen/src/fs/hfsplus/catalog.c b/debian/binary-custom.d/xen/src/fs/hfsplus/catalog.c index f6874ac..8a7cbcf 100644 --- a/debian/binary-custom.d/xen/src/fs/hfsplus/catalog.c +++ b/debian/binary-custom.d/xen/src/fs/hfsplus/catalog.c @@ -329,6 +329,10 @@ int hfsplus_rename_cat(u32 cnid, err = hfs_brec_find(&src_fd); if (err) goto out; + if (src_fd.entrylength > sizeof(entry) || src_fd.entrylength < 0) { + err = -EIO; + goto out; + } hfs_bnode_read(src_fd.bnode, &entry, src_fd.entryoffset, src_fd.entrylength); diff --git a/debian/binary-custom.d/xen/src/fs/hfsplus/dir.c b/debian/binary-custom.d/xen/src/fs/hfsplus/dir.c index 078684f..2d57b2b 100644 --- a/debian/binary-custom.d/xen/src/fs/hfsplus/dir.c +++ b/debian/binary-custom.d/xen/src/fs/hfsplus/dir.c @@ -138,6 +138,11 @@ static int hfsplus_readdir(struct file *filp, void *dirent, filldir_t filldir) filp->f_pos++; /* fall through */ case 1: + if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) { + err = -EIO; + goto out; + } + hfs_bnode_read(fd.bnode, &entry, fd.entryoffset, fd.entrylength); if (be16_to_cpu(entry.type) != HFSPLUS_FOLDER_THREAD) { printk(KERN_ERR "hfs: bad catalog folder thread\n"); @@ -168,6 +173,12 @@ static int hfsplus_readdir(struct file *filp, void *dirent, filldir_t filldir) err = -EIO; goto out; } + + if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) { + err = -EIO; + goto out; + } + hfs_bnode_read(fd.bnode, &entry, fd.entryoffset, fd.entrylength); type = be16_to_cpu(entry.type); len = HFSPLUS_MAX_STRLEN;