0ccef97f0c
[ Upstream commit e63866a475562810500ea7f784099bfe341e761a ]
In dbNextAG() , there is no check for the case where bmp->db_numag is
greater or same than MAXAG due to a polluted image, which causes an
out-of-bounds. Therefore, a bounds check should be added in dbMount().
And in dbNextAG(), a check for the case where agpref is greater than
bmp->db_numag should be added, so an out-of-bounds exception should be
prevented.
Additionally, a check for the case where agno is greater or same than
MAXAG should be added in diAlloc() to prevent out-of-bounds.
Reported-by: Jeongjun Park <aha310510@gmail.com>
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Jeongjun Park <aha310510@gmail.com>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
|
||
|---|---|---|
| .. | ||
| acl.c | ||
| file.c | ||
| inode.c | ||
| ioctl.c | ||
| jfs_acl.h | ||
| jfs_btree.h | ||
| jfs_debug.c | ||
| jfs_debug.h | ||
| jfs_dinode.h | ||
| jfs_discard.c | ||
| jfs_discard.h | ||
| jfs_dmap.c | ||
| jfs_dmap.h | ||
| jfs_dtree.c | ||
| jfs_dtree.h | ||
| jfs_extent.c | ||
| jfs_extent.h | ||
| jfs_filsys.h | ||
| jfs_imap.c | ||
| jfs_imap.h | ||
| jfs_incore.h | ||
| jfs_inode.c | ||
| jfs_inode.h | ||
| jfs_lock.h | ||
| jfs_logmgr.c | ||
| jfs_logmgr.h | ||
| jfs_metapage.c | ||
| jfs_metapage.h | ||
| jfs_mount.c | ||
| jfs_superblock.h | ||
| jfs_txnmgr.c | ||
| jfs_txnmgr.h | ||
| jfs_types.h | ||
| jfs_umount.c | ||
| jfs_unicode.c | ||
| jfs_unicode.h | ||
| jfs_uniupr.c | ||
| jfs_xattr.h | ||
| jfs_xtree.c | ||
| jfs_xtree.h | ||
| Kconfig | ||
| Makefile | ||
| namei.c | ||
| resize.c | ||
| super.c | ||
| symlink.c | ||
| xattr.c | ||