[gentoo-commits] linux-patches r1381 - genpatches-2.6/trunk/2.6.26

[Daniel Drake (dsd)]

Author: dsd
Date: 2008-11-19 11:31:08 +0000 (Wed, 19 Nov 2008)
New Revision: 1381

Added:
   genpatches-2.6/trunk/2.6.26/1905_hfs-namelength-corruption.patch
Modified:
   genpatches-2.6/trunk/2.6.26/0000_README
Log:
Fix hfs security issue with long catalog names

Modified: genpatches-2.6/trunk/2.6.26/0000_README
===================================================================
--- genpatches-2.6/trunk/2.6.26/0000_README	2008-11-19 11:14:34 UTC (rev 1380)
+++ genpatches-2.6/trunk/2.6.26/0000_README	2008-11-19 11:31:08 UTC (rev 1381)
@@ -75,6 +75,10 @@
 From:	http://bugs.gentoo.org/233307
 Desc:	Fix to add UTC timestamp option
 
+Patch:	1905_hfs-namelength-corruption.patch
+From:	http://bugs.gentoo.org/246710
+Desc:	Fix hfs security issue with long catalog names
+
 Patch:	2400_libertas-scan-buffer-overflow.patch
 From:	http://bugs.gentoo.org/247541
 Desc:	Fix libertas buffer overflow

Added: genpatches-2.6/trunk/2.6.26/1905_hfs-namelength-corruption.patch
===================================================================
--- genpatches-2.6/trunk/2.6.26/1905_hfs-namelength-corruption.patch	                        (rev 0)
+++ genpatches-2.6/trunk/2.6.26/1905_hfs-namelength-corruption.patch	2008-11-19 11:31:08 UTC (rev 1381)
@@ -0,0 +1,37 @@
+From: Eric Sesterhenn <snakebyte@×××.de>
+Date: Thu, 16 Oct 2008 05:04:11 +0000 (-0700)
+Subject: hfs: fix namelength memory corruption (CVE-2008-5025)
+X-Git-Tag: v2.6.27.6~2
+X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Fstable%2Flinux-2.6-stable.git;a=commitdiff_plain;h=3c050502c4166dc12009f35eb41fabe9c900cd43
+
+hfs: fix namelength memory corruption (CVE-2008-5025)
+
+commit d38b7aa7fc3371b52d036748028db50b585ade2e upstream
+
+Fix a stack corruption caused by a corrupted hfs filesystem.  If the
+catalog name length is corrupted the memcpy overwrites the catalog btree
+structure.  Since the field is limited to HFS_NAMELEN bytes in the
+structure and the file format, we throw an error if it is too long.
+
+Cc: Roman Zippel <zippel@××××××××××.org>
+Signed-off-by: Eric Sesterhenn <snakebyte@×××.de>
+Signed-off-by: Andrew Morton <akpm@××××××××××××××××.org>
+Signed-off-by: Linus Torvalds <torvalds@××××××××××××××××.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@××××.de>
+---
+
+diff --git a/fs/hfs/catalog.c b/fs/hfs/catalog.c
+index ba85157..6d98f11 100644
+--- a/fs/hfs/catalog.c
++++ b/fs/hfs/catalog.c
+@@ -190,6 +190,10 @@ int hfs_cat_find_brec(struct super_block *sb, u32 cnid,
+ 
+ 	fd->search_key->cat.ParID = rec.thread.ParID;
+ 	len = fd->search_key->cat.CName.len = rec.thread.CName.len;
++	if (len > HFS_NAMELEN) {
++		printk(KERN_ERR "hfs: bad catalog namelength\n");
++		return -EIO;
++	}
+ 	memcpy(fd->search_key->cat.CName.name, rec.thread.CName.name, len);
+ 	return hfs_brec_find(fd);
+ }