diff options
| author | Jan Kara <jack@suse.cz> | 2017-07-18 12:27:56 +0200 |
|---|---|---|
| committer | Jan Kara <jack@suse.cz> | 2017-07-18 12:33:16 +0200 |
| commit | 34363c057b368114d8b93376ec6b65ef5f36a55b (patch) | |
| tree | 7108d5e9650581495e1733188f453cec9711aa71 /fs/isofs | |
| parent | fcea8aed91f53b51f9b943dc01f12d8aa666c720 (diff) | |
| download | linux-0-day-34363c057b368114d8b93376ec6b65ef5f36a55b.tar.gz linux-0-day-34363c057b368114d8b93376ec6b65ef5f36a55b.tar.xz | |
isofs: Fix off-by-one in 'session' mount option parsing
According to ECMA-130 standard maximum valid track number is 99. Since
'session' mount option starts indexing at 0 (and we add 1 to the passed
number), we should refuse value 99. Also the condition in
isofs_get_last_session() unnecessarily repeats the check - remove it.
Reported-by: David Howells <dhowells@redhat.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Diffstat (limited to 'fs/isofs')
| -rw-r--r-- | fs/isofs/inode.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c index 8cf898a59730d..217a5e7815da6 100644 --- a/fs/isofs/inode.c +++ b/fs/isofs/inode.c @@ -410,7 +410,11 @@ static int parse_options(char *options, struct iso9660_options *popt) if (match_int(&args[0], &option)) return 0; n = option; - if (n > 99) + /* + * Track numbers are supposed to be in range 1-99, the + * mount option starts indexing at 0. + */ + if (n >= 99) return 0; popt->session = n + 1; break; @@ -543,7 +547,7 @@ static unsigned int isofs_get_last_session(struct super_block *sb, s32 session) vol_desc_start=0; ms_info.addr_format=CDROM_LBA; - if(session >= 0 && session <= 99) { + if (session > 0) { struct cdrom_tocentry Te; Te.cdte_track=session; Te.cdte_format=CDROM_LBA; |