xfs: Fix integer overflow in fs/xfs/linux-2.6/xfs_ioctl*.c

Browse source

The am_hreq.opcount field in the xfs_attrmulti_by_handle() interface
is not bounded correctly. The opcount is used to determine the size
of the buffer required. The size is bounded, but can overflow and so
the size checks may not be sufficient to catch invalid opcounts.
Fix it by catching opcount values that would cause overflows before
calculating the size.

Signed-off-by: Zhitong Wang <zhitong.wangzt@alibaba-inc.com>
Reviewed-by: Dave Chinner <david@fromorbit.com>

...

This commit is contained in:

Zhitong Wang 2010-03-23 09:51:22 +11:00 • committed by Alex Elder

parent e40152ee1e

commit fda168c245

2 changed files with 8 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

4

fs/xfs/linux-2.6/xfs_ioctl.c

View file

4

fs/xfs/linux-2.6/xfs_ioctl32.c

View file