--- fs/squashfs/namei.c

+++ fs/squashfs/namei.c

@@ -175,6 +175,11 @@ static struct dentry *squashfs_lookup(st

length += sizeof(dirh);

dir_count = le32_to_cpu(dirh.count) + 1;

+

+ /* dir_count should never be larger than 256 */

+ if (dir_count > 256)

+ goto data_error;

+

while (dir_count--) {

/*

* Read directory entry.

@@ -186,6 +191,10 @@ static struct dentry *squashfs_lookup(st

size = le16_to_cpu(dire->size) + 1;

+ /* size should never be larger than SQUASHFS_NAME_LEN */

+ if (size > SQUASHFS_NAME_LEN)

+ goto data_error;

+

err = squashfs_read_metadata(dir->i_sb, dire->name,

&block, &offset, size);

if (err < 0)

@@ -227,6 +236,9 @@ exit_lookup:

d_add(dentry, inode);

return ERR_PTR(0);

+data_error:

+ err = -EIO;

+

read_failure:

ERROR("Unable to read directory block [%llx:%x]\n",

squashfs_i(dir)->start + msblk->directory_table,