fs/squashfs: sqfs_read: don't write beyond buffer size
The length of the buffer wasn't taken into account when writing to the
given buffer.
Signed-off-by: Richard Genoud <richard.genoud@posteo.net>
diff --git a/fs/squashfs/sqfs.c b/fs/squashfs/sqfs.c
index 4350816..1ecdd01 100644
--- a/fs/squashfs/sqfs.c
+++ b/fs/squashfs/sqfs.c
@@ -1415,6 +1415,8 @@
}
finfo.size = len;
+ } else {
+ len = finfo.size;
}
if (datablk_count) {
@@ -1461,9 +1463,13 @@
if (ret)
goto out;
+ if ((*actread + dest_len) > len)
+ dest_len = len - *actread;
memcpy(buf + offset + *actread, datablock, dest_len);
*actread += dest_len;
} else {
+ if ((*actread + table_size) > len)
+ table_size = len - *actread;
memcpy(buf + offset + *actread, data, table_size);
*actread += table_size;
}
@@ -1471,6 +1477,8 @@
data_offset += table_size;
free(data_buffer);
data_buffer = NULL;
+ if (*actread >= len)
+ break;
}
/*