git.openpandora.org
/
pandora-kernel.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
Merge branch 'for-linus' of git://oss.sgi.com/xfs/xfs
[pandora-kernel.git]
/
fs
/
xfs
/
linux-2.6
/
xfs_ioctl32.c
diff --git
a/fs/xfs/linux-2.6/xfs_ioctl32.c
b/fs/xfs/linux-2.6/xfs_ioctl32.c
index
593c05b
..
9287135
100644
(file)
--- a/
fs/xfs/linux-2.6/xfs_ioctl32.c
+++ b/
fs/xfs/linux-2.6/xfs_ioctl32.c
@@
-420,6
+420,10
@@
xfs_compat_attrmulti_by_handle(
sizeof(compat_xfs_fsop_attrmulti_handlereq_t)))
return -XFS_ERROR(EFAULT);
sizeof(compat_xfs_fsop_attrmulti_handlereq_t)))
return -XFS_ERROR(EFAULT);
+ /* overflow check */
+ if (am_hreq.opcount >= INT_MAX / sizeof(compat_xfs_attr_multiop_t))
+ return -E2BIG;
+
dentry = xfs_compat_handlereq_to_dentry(parfilp, &am_hreq.hreq);
if (IS_ERR(dentry))
return PTR_ERR(dentry);
dentry = xfs_compat_handlereq_to_dentry(parfilp, &am_hreq.hreq);
if (IS_ERR(dentry))
return PTR_ERR(dentry);