Silvio Cesare 9c3a27c0ca UBIFS: Fix potential integer overflow in allocation ... commit 353748a359f1821ee934afc579cf04572406b420 upstream. There is potential for the size and len fields in ubifs_data_node to be too large causing either a negative value for the length fields or an integer overflow leading to an incorrect memory allocation. Likewise, when the len field is small, an integer underflow may occur. Signed-off-by: Silvio Cesare <silvio.cesare@gmail.com> Fixes: 1e51764a3c ("UBIFS: add new flash file system") Cc: stable@vger.kernel.org Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2018-07-03 11:21:32 +02:00
..
budget.c
commit.c
compress.c
debug.c
debug.h
dir.c
file.c
find.c
gc.c
io.c
ioctl.c
journal.c
Kconfig
key.h
log.c
lprops.c
lpt_commit.c
lpt.c
Makefile
master.c
misc.h
orphan.c
recovery.c
replay.c
sb.c
scan.c
shrinker.c
super.c
tnc_commit.c
tnc_misc.c
tnc.c
ubifs-media.h
ubifs.h
xattr.c