[PATCH] qnx4: validate xblk_num_xtnts and rootdir size in qnx4_block_map() and mount

[Hui Peng]

In qnx4_block_map() and qnx4_fill_super() (fs/qnx4/inode.c), check that
xblk->xblk_num_xtnts is between 1 and QNX4_MAX_XTNTS_PER_XBLK (60),
return 0 instead of (unsigned long)-EIO on error, and validate the root
directory inode size on mount to prevent out-of-bounds reads past the
512-byte buffer_head.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@xxxxxxxxx>
---
diff --git a/fs/qnx4/inode.c b/fs/qnx4/inode.c
index 42fcd500fad2..f6eb08cac09b 100644
--- a/fs/qnx4/inode.c
+++ b/fs/qnx4/inode.c
@@ -104,12 +104,15 @@ unsigned long qnx4_block_map( struct inode *inode, long iblock )
 				bh = sb_bread(inode->i_sb, i_xblk - 1);
 				if ( !bh ) {
 					QNX4DEBUG((KERN_ERR "qnx4: I/O error reading xtnt block [%ld])\n", i_xblk - 1));
-					return -EIO;
+					return 0;
 				}
 				xblk = (struct qnx4_xblk*)bh->b_data;
-				if ( memcmp( xblk->xblk_signature, "IamXblk", 7 ) ) {
+				if (memcmp(xblk->xblk_signature, "IamXblk", 7) ||
+				    xblk->xblk_num_xtnts == 0 ||
+				    xblk->xblk_num_xtnts > QNX4_MAX_XTNTS_PER_XBLK) {
 					QNX4DEBUG((KERN_ERR "qnx4: block at %ld is not a valid xtnt\n", qnx4_inode->i_xblk));
-					return -EIO;
+					brelse(bh);
+					return 0;
 				}
 			}
 			block = try_extent(&xblk->xblk_xtnts[ix], &offset);