Andrew Morton <[EMAIL PROTECTED]> wrote: > > It's the new rock-ridge bounds checking.
Try this, please? diff -puN fs/isofs/rock.c~rock-handle-directory-overflows-fix fs/isofs/rock.c --- 25/fs/isofs/rock.c~rock-handle-directory-overflows-fix Fri Mar 25 14:21:32 2005 +++ 25-akpm/fs/isofs/rock.c Fri Mar 25 14:22:01 2005 @@ -218,12 +218,12 @@ repeat: if (rr->len < 3) goto out; /* Something got screwed up here */ sig = isonum_721(rs.chr); + if (rock_check_overflow(&rs, sig)) + goto eio; rs.chr += rr->len; rs.len -= rr->len; if (rs.len < 0) goto eio; /* corrupted isofs */ - if (rock_check_overflow(&rs, sig)) - goto eio; switch (sig) { case SIG('R', 'R'): @@ -316,12 +316,12 @@ repeat: if (rr->len < 3) goto out; /* Something got screwed up here */ sig = isonum_721(rs.chr); + if (rock_check_overflow(&rs, sig)) + goto eio; rs.chr += rr->len; rs.len -= rr->len; if (rs.len < 0) goto eio; /* corrupted isofs */ - if (rock_check_overflow(&rs, sig)) - goto eio; switch (sig) { #ifndef CONFIG_ZISOFS /* No flag for SF or ZF */ @@ -694,12 +694,12 @@ repeat: if (rr->len < 3) goto out; /* Something got screwed up here */ sig = isonum_721(rs.chr); + if (rock_check_overflow(&rs, sig)) + goto out; rs.chr += rr->len; rs.len -= rr->len; if (rs.len < 0) goto out; /* corrupted isofs */ - if (rock_check_overflow(&rs, sig)) - goto out; switch (sig) { case SIG('R', 'R'): _ - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/