diff options
| author |   David Lee <david.lee@trailofbits.com> | 2026-07-17 10:47:21 +0000 |
|---|---|---|
| committer |   Jan Kara <jack@suse.cz> | 2026-07-17 14:02:13 +0200 |
| commit | d23eb7380d1594cda31a5dc8487dd2a5c8def8c7 (patch) | |
| tree | ea0ef5000783ea3eb9ee5cdb06f309131fa4d679 | |
| parent | isofs: fix out-of-bounds page array access on empty zisofs block (diff) | |
UDF symlink pathComponent header OOB read
udf_symlink_filler() can enter udf_pc_to_char() with a partial pathComponent header.
Validate that enough input remains for a complete pathComponent header
before accessing it. Reject malformed symlink data that would otherwise
make udf_pc_to_char() perform an out-of-bounds read.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: David Lee <david.lee@trailofbits.com>
Assisted-by: Codex:gpt-5.5
Link: https://patch.msgid.link/20260717104722.41446-1-david.lee@trailofbits.com
Signed-off-by: Jan Kara <jack@suse.cz>
| -rw-r--r-- | fs/udf/symlink.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/fs/udf/symlink.c b/fs/udf/symlink.c index fe03745d09b1..a05d1888a2ba 100644 --- a/fs/udf/symlink.c +++ b/fs/udf/symlink.c @@ -36,6 +36,8 @@ static int udf_pc_to_char(struct super_block *sb, unsigned char *from, /* Reserve one byte for terminating \0 */ tolen--; while (elen < fromlen) { + if (fromlen - elen < sizeof(struct pathComponent)) + return -EIO; pc = (struct pathComponent *)(from + elen); elen += sizeof(struct pathComponent); switch (pc->componentType) { |