@@ -16,6 +16,30 @@ static unsigned int adfs_fplus_offset(const struct adfs_bigdirheader *h,
16
16
pos * sizeof (struct adfs_bigdirentry );
17
17
}
18
18
19
+ static int adfs_fplus_validate_header (const struct adfs_bigdirheader * h )
20
+ {
21
+ unsigned int size = le32_to_cpu (h -> bigdirsize );
22
+
23
+ if (h -> bigdirversion [0 ] != 0 || h -> bigdirversion [1 ] != 0 ||
24
+ h -> bigdirversion [2 ] != 0 ||
25
+ h -> bigdirstartname != cpu_to_le32 (BIGDIRSTARTNAME ) ||
26
+ size & 2047 )
27
+ return - EIO ;
28
+
29
+ return 0 ;
30
+ }
31
+
32
+ static int adfs_fplus_validate_tail (const struct adfs_bigdirheader * h ,
33
+ const struct adfs_bigdirtail * t )
34
+ {
35
+ if (t -> bigdirendname != cpu_to_le32 (BIGDIRENDNAME ) ||
36
+ t -> bigdirendmasseq != h -> startmasseq ||
37
+ t -> reserved [0 ] != 0 || t -> reserved [1 ] != 0 )
38
+ return - EIO ;
39
+
40
+ return 0 ;
41
+ }
42
+
19
43
static int adfs_fplus_read (struct super_block * sb , u32 indaddr ,
20
44
unsigned int size , struct adfs_dir * dir )
21
45
{
@@ -30,20 +54,18 @@ static int adfs_fplus_read(struct super_block *sb, u32 indaddr,
30
54
return ret ;
31
55
32
56
dir -> bighead = h = (void * )dir -> bhs [0 ]-> b_data ;
57
+ if (adfs_fplus_validate_header (h )) {
58
+ adfs_error (sb , "dir %06x has malformed header" , indaddr );
59
+ goto out ;
60
+ }
61
+
33
62
dirsize = le32_to_cpu (h -> bigdirsize );
34
63
if (dirsize != size ) {
35
64
adfs_msg (sb , KERN_WARNING ,
36
65
"dir %06x header size %X does not match directory size %X" ,
37
66
indaddr , dirsize , size );
38
67
}
39
68
40
- if (h -> bigdirversion [0 ] != 0 || h -> bigdirversion [1 ] != 0 ||
41
- h -> bigdirversion [2 ] != 0 || size & 2047 ||
42
- h -> bigdirstartname != cpu_to_le32 (BIGDIRSTARTNAME )) {
43
- adfs_error (sb , "dir %06x has malformed header" , indaddr );
44
- goto out ;
45
- }
46
-
47
69
/* Read remaining buffers */
48
70
ret = adfs_dir_read_buffers (sb , indaddr , dirsize , dir );
49
71
if (ret )
@@ -52,9 +74,8 @@ static int adfs_fplus_read(struct super_block *sb, u32 indaddr,
52
74
dir -> bigtail = t = (struct adfs_bigdirtail * )
53
75
(dir -> bhs [dir -> nr_buffers - 1 ]-> b_data + (sb -> s_blocksize - 8 ));
54
76
55
- if (t -> bigdirendname != cpu_to_le32 (BIGDIRENDNAME ) ||
56
- t -> bigdirendmasseq != h -> startmasseq ||
57
- t -> reserved [0 ] != 0 || t -> reserved [1 ] != 0 ) {
77
+ ret = adfs_fplus_validate_tail (h , t );
78
+ if (ret ) {
58
79
adfs_error (sb , "dir %06x has malformed tail" , indaddr );
59
80
goto out ;
60
81
}
0 commit comments