From cbd5e40ede4e5c6aedce9475325bdf80b7fa839b Mon Sep 17 00:00:00 2001 From: Richard Genoud Date: Tue, 3 Nov 2020 12:11:23 +0100 Subject: [PATCH] fs/squashfs: sqfs_read: don't write beyond buffer size The length of the buffer wasn't taken into account when writing to the given buffer. Signed-off-by: Richard Genoud --- fs/squashfs/sqfs.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/fs/squashfs/sqfs.c b/fs/squashfs/sqfs.c index 4350816..1ecdd01 100644 --- a/fs/squashfs/sqfs.c +++ b/fs/squashfs/sqfs.c @@ -1415,6 +1415,8 @@ int sqfs_read(const char *filename, void *buf, loff_t offset, loff_t len, } finfo.size = len; + } else { + len = finfo.size; } if (datablk_count) { @@ -1461,9 +1463,13 @@ int sqfs_read(const char *filename, void *buf, loff_t offset, loff_t len, if (ret) goto out; + if ((*actread + dest_len) > len) + dest_len = len - *actread; memcpy(buf + offset + *actread, datablock, dest_len); *actread += dest_len; } else { + if ((*actread + table_size) > len) + table_size = len - *actread; memcpy(buf + offset + *actread, data, table_size); *actread += table_size; } @@ -1471,6 +1477,8 @@ int sqfs_read(const char *filename, void *buf, loff_t offset, loff_t len, data_offset += table_size; free(data_buffer); data_buffer = NULL; + if (*actread >= len) + break; } /* -- 2.7.4