Re: [reiserfs-list] major security bug in reiserfs (may affect SuSE Linux)

[Hans Reiser <reiser@namesys.com>]

Chris Mason wrote:
> 
> On Wednesday, January 10, 2001 02:32:09 AM +0100 Marc Lehmann <pcg@goof.com> wrote:
> >>> EIP; c013f911 <filldir+20b/221>   <=====
> > Trace; c013f706 <filldir+0/221>
> > Trace; c0136e01 <reiserfs_getblk+2a/16d>
> >
> 
> Here is a patch against our 2.4 code (3.6.25) that does the
> same as the patch posted for 3.5.29:
> 
> -chris
> 
> --- linux/include/linux/reiserfs_fs.h.1 Tue Jan  9 21:22:27 2001
> +++ linux/include/linux/reiserfs_fs.h   Tue Jan  9 21:22:55 2001
> @@ -926,8 +926,7 @@
>  //((block_size - BLKH_SIZE - IH_SIZE - DEH_SIZE * 2) / 2)
> 
>  // two entries per block (at least)
> -#define REISERFS_MAX_NAME_LEN(block_size) \
> -((block_size - BLKH_SIZE - IH_SIZE - DEH_SIZE))
> +#define REISERFS_MAX_NAME_LEN(block_size) 255
> 
> 
> 
> --- linux/fs/reiserfs/dir.c.1   Tue Jan  9 21:22:19 2001
> +++ linux/fs/reiserfs/dir.c     Tue Jan  9 21:21:02 2001
> @@ -142,6 +142,10 @@
>                 if (!d_name[d_reclen - 1])
>                     d_reclen = strlen (d_name);
> 
> +               if (d_reclen > REISERFS_MAX_NAME_LEN(inode->i_sb->s_blocksize)){
> +                   /* too big to send back to VFS */
> +                   continue ;
> +               }
>                 d_off = deh_offset (deh);
>                 filp->f_pos = d_off ;
>                 d_ino = deh_objectid (deh);


I think that in the short term, so as to make it easier to merge us into 2.4, it is reasonable to
restrict us to small names, so go ahead and merge this code into cvs if not done already.

Hans
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
Please read the FAQ at http://www.tux.org/lkml/