55d41b0a20
udf_read_tagged() skips CRC verification when descCRCLength +
sizeof(struct tag) exceeds the block size. A crafted UDF image can
set descCRCLength to an oversized value to bypass CRC validation
entirely; the descriptor is then accepted based solely on the 8-bit
tag checksum, which is trivially recomputable.
Reject such descriptors instead of silently accepting them. A
legitimate single-block descriptor should never have a CRC length that
exceeds the block.
Fixes:
|
||
|---|---|---|
| .. | ||
| balloc.c | ||
| dir.c | ||
| directory.c | ||
| ecma_167.h | ||
| file.c | ||
| ialloc.c | ||
| inode.c | ||
| Kconfig | ||
| lowlevel.c | ||
| Makefile | ||
| misc.c | ||
| namei.c | ||
| osta_udf.h | ||
| partition.c | ||
| super.c | ||
| symlink.c | ||
| truncate.c | ||
| udf_i.h | ||
| udf_sb.h | ||
| udfdecl.h | ||
| udfend.h | ||
| udftime.c | ||
| unicode.c | ||