diff options
| author | Konstantin Belousov <kib@FreeBSD.org> | 2023-08-04 22:47:09 +0000 |
|---|---|---|
| committer | Konstantin Belousov <kib@FreeBSD.org> | 2023-08-04 22:49:36 +0000 |
| commit | 9e6941a2c7a393aefe6a123952c6eacbc23098a6 (patch) | |
| tree | 7fdec5e2b5755cb19384ec32340848d05a6108db | |
| parent | efb04fb404b240a99c618e49174cd6260217edaa (diff) | |
| download | src-9e6941a2c7a393aefe6a123952c6eacbc23098a6.tar.gz src-9e6941a2c7a393aefe6a123952c6eacbc23098a6.zip | |
udf: reject invalid block sizes from lvd
PR: 272893
Reported by: Robert Morris <rtm@lcs.mit.edu>
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
| -rw-r--r-- | sys/fs/udf/udf_vfsops.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/sys/fs/udf/udf_vfsops.c b/sys/fs/udf/udf_vfsops.c index 0b028718085a..a8aa811a0d6c 100644 --- a/sys/fs/udf/udf_vfsops.c +++ b/sys/fs/udf/udf_vfsops.c @@ -413,6 +413,11 @@ udf_mountfs(struct vnode *devvp, struct mount *mp) lvd = (struct logvol_desc *)bp->b_data; if (!udf_checktag(&lvd->tag, TAGID_LOGVOL)) { udfmp->bsize = le32toh(lvd->lb_size); + if (udfmp->bsize < 0 || udfmp->bsize > maxbcachebuf) { + printf("lvd block size %d\n", udfmp->bsize); + error = EINVAL; + goto bail; + } udfmp->bmask = udfmp->bsize - 1; udfmp->bshift = ffs(udfmp->bsize) - 1; fsd_part = le16toh(lvd->_lvd_use.fsd_loc.loc.part_num); |