Abort if we fail to parse the cpio header, instead of using potentially bogus header values. Signed-off-by: David Disseldorp --- init/initramfs.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/init/initramfs.c b/init/initramfs.c index 8d931ad4d239b..84d94dc71e8f0 100644 --- a/init/initramfs.c +++ b/init/initramfs.c @@ -193,14 +193,16 @@ static __initdata gid_t gid; static __initdata unsigned rdev; static __initdata u32 hdr_csum; -static void __init parse_header(char *s) +static int __init parse_header(char *s) { __be32 header[13]; int ret; ret = hex2bin((u8 *)header, s + 6, sizeof(header)); - if (ret) + if (ret) { error("damaged header"); + return ret; + } ino = be32_to_cpu(header[0]); mode = be32_to_cpu(header[1]); @@ -214,6 +216,7 @@ static void __init parse_header(char *s) rdev = new_encode_dev(MKDEV(be32_to_cpu(header[9]), be32_to_cpu(header[10]))); name_len = be32_to_cpu(header[11]); hdr_csum = be32_to_cpu(header[12]); + return 0; } /* FSM */ @@ -293,7 +296,8 @@ static int __init do_header(void) error("no cpio magic"); return 1; } - parse_header(collected); + if (parse_header(collected)) + return 1; next_header = this_header + N_ALIGN(name_len) + body_len; next_header = (next_header + 3) & ~3; state = SkipIt; -- 2.51.0