squashfs: be more careful about metadata corruption

Anatoly Trosinenko reports that a corrupted squashfs image can cause a
kernel oops.  It turns out that squashfs can end up being confused about
negative fragment lengths.

The regular squashfs_read_data() does check for negative lengths, but
squashfs_read_metadata() did not, and the fragment size code just
blindly trusted the on-disk value.  Fix both the fragment parsing and
the metadata reading code.

Reported-by: Anatoly Trosinenko <[email protected]>
Cc: Al Viro <[email protected]>
Cc: Phillip Lougher <[email protected]>
Cc: [email protected]
Signed-off-by: Linus Torvalds <[email protected]>

0 files changed, 0 insertions, 0 deletions