X-Git-Url: https://git.openpandora.org/cgi-bin/gitweb.cgi?p=pandora-kernel.git;a=blobdiff_plain;f=fs%2Fudf%2Finode.c;h=5d67e2023311e3b28e9b614f213d10004155cf64;hp=e0814407652a6eec61d697f1f6097605c409b6e9;hb=ef16fa90c41f032db95b7aae74e4a6ad21a283e9;hpb=be23a28ef52914d32502b776f9ecba7f820a3f24;ds=sidebyside

diff --git a/fs/udf/inode.c b/fs/udf/inode.c
index e0814407652a..5d67e2023311 100644
--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -1975,14 +1975,29 @@ void udf_write_aext(struct inode *inode, struct extent_position *epos,
 		epos->offset += adsize;
 }
 
+/*
+ * Only 1 indirect extent in a row really makes sense but allow upto 16 in case
+ * someone does some weird stuff.
+ */
+#define UDF_MAX_INDIR_EXTS 16
+
 int8_t udf_next_aext(struct inode *inode, struct extent_position *epos,
 		     struct kernel_lb_addr *eloc, uint32_t *elen, int inc)
 {
 	int8_t etype;
+	unsigned int indirections = 0;
 
 	while ((etype = udf_current_aext(inode, epos, eloc, elen, inc)) ==
 	       (EXT_NEXT_EXTENT_ALLOCDECS >> 30)) {
 		int block;
+
+		if (++indirections > UDF_MAX_INDIR_EXTS) {
+			udf_err(inode->i_sb,
+				"too many indirect extents in inode %lu\n",
+				inode->i_ino);
+			return -1;
+		}
+
 		epos->block = *eloc;
 		epos->offset = sizeof(struct allocExtDesc);
 		brelse(epos->bh);