diff options
| author |   Timo Warns <warns@pre-sense.de> | 2011-02-17 22:27:40 +0100 |
|---|---|---|
| committer |   Linus Torvalds <torvalds@linux-foundation.org> | 2011-02-17 17:50:51 -0800 |
| commit | fa7ea87a057958a8b7926c1a60a3ca6d696328ed (patch) | |
| tree | 4795fb5b14dfd3112b650456007e167eb90c1645 /fs/partitions/mac.c | |
| parent | Merge branch 'for-2.6.38' of git://linux-nfs.org/~bfields/linux (diff) | |
| download | linux-dev-fa7ea87a057958a8b7926c1a60a3ca6d696328ed.tar.xz linux-dev-fa7ea87a057958a8b7926c1a60a3ca6d696328ed.zip | |
fs/partitions: Validate map_count in Mac partition tables
Validate number of blocks in map and remove redundant variable.
Signed-off-by: Timo Warns <warns@pre-sense.de>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to '')
| -rw-r--r-- | fs/partitions/mac.c | 17 |
1 files changed, 9 insertions, 8 deletions
diff --git a/fs/partitions/mac.c b/fs/partitions/mac.c index 68d6a216ee79..11f688bd76c5 100644 --- a/fs/partitions/mac.c +++ b/fs/partitions/mac.c @@ -29,10 +29,9 @@ static inline void mac_fix_string(char *stg, int len) int mac_partition(struct parsed_partitions *state) { - int slot = 1; Sector sect; unsigned char *data; - int blk, blocks_in_map; + int slot, blocks_in_map; unsigned secsize; #ifdef CONFIG_PPC_PMAC int found_root = 0; @@ -59,10 +58,14 @@ int mac_partition(struct parsed_partitions *state) put_dev_sector(sect); return 0; /* not a MacOS disk */ } - strlcat(state->pp_buf, " [mac]", PAGE_SIZE); blocks_in_map = be32_to_cpu(part->map_count); - for (blk = 1; blk <= blocks_in_map; ++blk) { - int pos = blk * secsize; + if (blocks_in_map < 0 || blocks_in_map >= DISK_MAX_PARTS) { + put_dev_sector(sect); + return 0; + } + strlcat(state->pp_buf, " [mac]", PAGE_SIZE); + for (slot = 1; slot <= blocks_in_map; ++slot) { + int pos = slot * secsize; put_dev_sector(sect); data = read_part_sector(state, pos/512, §); if (!data) @@ -113,13 +116,11 @@ int mac_partition(struct parsed_partitions *state) } if (goodness > found_root_goodness) { - found_root = blk; + found_root = slot; found_root_goodness = goodness; } } #endif /* CONFIG_PPC_PMAC */ - - ++slot; } #ifdef CONFIG_PPC_PMAC if (found_root_goodness) |