Silvio Cesare 353748a359 UBIFS: Fix potential integer overflow in allocation
There is potential for the size and len fields in ubifs_data_node to be
too large causing either a negative value for the length fields or an
integer overflow leading to an incorrect memory allocation. Likewise,
when the len field is small, an integer underflow may occur.

Signed-off-by: Silvio Cesare <silvio.cesare@gmail.com>
Fixes: 1e51764a3c2ac ("UBIFS: add new flash file system")
Cc: stable@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
2018-06-12 16:19:22 -07:00
..
2018-05-21 14:30:07 -04:00
2018-06-04 14:29:13 -07:00
2018-06-11 10:16:13 -07:00
2018-06-05 13:24:20 -07:00
2018-06-11 10:16:13 -07:00
2018-06-11 10:16:13 -07:00
2018-06-07 08:50:57 -07:00
2018-06-05 13:24:20 -07:00
2018-06-12 16:19:22 -07:00
2018-06-05 16:29:19 -07:00
2018-03-27 13:18:09 -04:00
2018-05-22 14:27:52 -04:00
2018-06-04 07:58:06 -07:00
2018-06-07 09:23:12 -07:00
2018-06-09 15:31:35 -07:00
2018-05-22 14:27:52 -04:00
2018-05-21 14:30:09 -04:00
2018-05-22 14:27:53 -04:00
\n
2018-06-07 09:36:29 -07:00
2018-06-08 17:21:52 -07:00
2018-06-07 17:34:40 -07:00
2018-06-05 19:23:26 +02:00
2018-06-08 17:21:52 -07:00
2018-05-26 09:16:44 +02:00
2018-06-07 17:34:35 -07:00
2018-05-03 16:11:37 -06:00
2018-06-07 08:53:50 -07:00
2018-06-11 08:22:34 -07:00
2018-05-26 09:16:44 +02:00
2018-04-04 12:44:02 -07:00
2018-05-26 09:16:44 +02:00