diff options
| author |   otto <otto@openbsd.org> | 2008-11-02 08:54:10 +0000 |
|---|---|---|
| committer | otto <otto@openbsd.org> | 2008-11-02 08:54:10 +0000 |
| commit | 16f07c2390a6e52235c18f9a5dfda17ed72b0ad6 (patch) | |
| tree | 7d789869caa4863ccef8f4d28b4b617932dc1589 | |
| parent | introduce a macro for max file size, instead of hardcoding it; ok (diff) | |
| download | wireguard-openbsd-16f07c2390a6e52235c18f9a5dfda17ed72b0ad6.tar.xz wireguard-openbsd-16f07c2390a6e52235c18f9a5dfda17ed72b0ad6.zip | |
check for the maximum file size to avoid some out-of-bounds accesses;
ok millert@
| -rw-r--r-- | sbin/fsck_ffs/pass1.c | 12 |
1 files changed, 8 insertions, 4 deletions
diff --git a/sbin/fsck_ffs/pass1.c b/sbin/fsck_ffs/pass1.c index 0e0f3bd5e5c..4da58abf8c9 100644 --- a/sbin/fsck_ffs/pass1.c +++ b/sbin/fsck_ffs/pass1.c @@ -1,4 +1,4 @@ -/* $OpenBSD: pass1.c,v 1.27 2008/06/10 23:10:29 otto Exp $ */ +/* $OpenBSD: pass1.c,v 1.28 2008/11/02 08:54:10 otto Exp $ */ /* $NetBSD: pass1.c,v 1.16 1996/09/27 22:45:15 christos Exp $ */ /* @@ -34,7 +34,7 @@ #if 0 static char sccsid[] = "@(#)pass1.c 8.1 (Berkeley) 6/5/93"; #else -static const char rcsid[] = "$OpenBSD: pass1.c,v 1.27 2008/06/10 23:10:29 otto Exp $"; +static const char rcsid[] = "$OpenBSD: pass1.c,v 1.28 2008/11/02 08:54:10 otto Exp $"; #endif #endif /* not lint */ @@ -121,6 +121,7 @@ static void checkinode(ino_t inumber, struct inodesc *idesc) { union dinode *dp; + off_t kernmaxfilesize; struct zlncnt *zlnp; int ndb, j; mode_t mode; @@ -153,8 +154,11 @@ checkinode(ino_t inumber, struct inodesc *idesc) return; } lastino = inumber; - if (/* DIP(dp, di_size) < 0 || */ - DIP(dp, di_size) + sblock.fs_bsize - 1 < DIP(dp, di_size)) { + /* This should match the file size limit in ffs_mountfs(). */ + kernmaxfilesize = FS_KERNMAXFILESIZE(&sblock); + if (DIP(dp, di_size) > kernmaxfilesize || + DIP(dp, di_size) > sblock.fs_maxfilesize || + (mode == IFDIR && DIP(dp, di_size) > MAXDIRSIZE)) { if (debug) printf("bad size %llu:", (unsigned long long)DIP(dp, di_size)); |