diff --git a/fs/squashfs/inode.c b/fs/squashfs/inode.c index 16bd693d0b3a..6c4316d7dd24 100644 --- a/fs/squashfs/inode.c +++ b/fs/squashfs/inode.c @@ -279,6 +279,11 @@ int squashfs_read_inode(struct inode *inode, long long ino) if (err < 0) goto failed_read; + if (le32_to_cpu(sqsh_ino->symlink_size) > PAGE_SIZE) { + ERROR("Corrupted symlink\n"); + return -EINVAL; + } + set_nlink(inode, le32_to_cpu(sqsh_ino->nlink)); inode->i_size = le32_to_cpu(sqsh_ino->symlink_size); inode->i_op = &squashfs_symlink_inode_ops; @@ -287,6 +292,11 @@ int squashfs_read_inode(struct inode *inode, long long ino) inode->i_mode |= S_IFLNK; squashfs_i(inode)->start = block; squashfs_i(inode)->offset = offset; + if ((int)inode->i_size < 0) { + ERROR("Wrong i_size %d!\n", inode->i_size); + return -EINVAL; + } + if (type == SQUASHFS_LSYMLINK_TYPE) { __le32 xattr;