squashfs: Fix integer overflow in sqfs_inode_size()
A carefully crafted squashfs filesystem can exhibit an extremly large
inode size and overflow the calculation in sqfs_inode_size().
As a consequence, the squashfs driver will read from wrong locations.
Fix by using __builtin_add_overflow() to detect the overflow.
Signed-off-by: Richard Weinberger <richard@nod.at>
Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
diff --git a/fs/squashfs/sqfs_inode.c b/fs/squashfs/sqfs_inode.c
index d25cfb5..bb3ccd3 100644
--- a/fs/squashfs/sqfs_inode.c
+++ b/fs/squashfs/sqfs_inode.c
@@ -78,11 +78,16 @@
case SQFS_SYMLINK_TYPE:
case SQFS_LSYMLINK_TYPE: {
+ int size;
+
struct squashfs_symlink_inode *symlink =
(struct squashfs_symlink_inode *)inode;
- return sizeof(*symlink) +
- get_unaligned_le32(&symlink->symlink_size);
+ if (__builtin_add_overflow(sizeof(*symlink),
+ get_unaligned_le32(&symlink->symlink_size), &size))
+ return -EINVAL;
+
+ return size;
}
case SQFS_BLKDEV_TYPE: