X-Git-Url: http://git.onelab.eu/?a=blobdiff_plain;f=fs%2Fisofs%2Fcompress.c;h=4917315db732e881cecbd50e89573333205d9959;hb=43bc926fffd92024b46cafaf7350d669ba9ca884;hp=8877508ea039a6c5e61df1b67804ae1169ece5bf;hpb=5273a3df6485dc2ad6aa7ddd441b9a21970f003b;p=linux-2.6.git

diff --git a/fs/isofs/compress.c b/fs/isofs/compress.c
index 8877508ea..4917315db 100644
--- a/fs/isofs/compress.c
+++ b/fs/isofs/compress.c
@@ -18,30 +18,12 @@
 
 #include <linux/config.h>
 #include <linux/module.h>
-
-#include <linux/stat.h>
-#include <linux/time.h>
-#include <linux/iso_fs.h>
-#include <linux/kernel.h>
-#include <linux/major.h>
-#include <linux/mm.h>
-#include <linux/string.h>
-#include <linux/slab.h>
-#include <linux/errno.h>
-#include <linux/cdrom.h>
 #include <linux/init.h>
-#include <linux/nls.h>
-#include <linux/ctype.h>
-#include <linux/smp_lock.h>
-#include <linux/blkdev.h>
+
 #include <linux/vmalloc.h>
 #include <linux/zlib.h>
-#include <linux/buffer_head.h>
-
-#include <asm/system.h>
-#include <asm/uaccess.h>
-#include <asm/semaphore.h>
 
+#include "isofs.h"
 #include "zisofs.h"
 
 /* This should probably be global. */
@@ -114,7 +96,7 @@ static int zisofs_readpage(struct file *file, struct page *page)
 	blockendptr = blockptr + 4;
 
 	indexblocks = ((blockptr^blockendptr) >> bufshift) ? 2 : 1;
-	ptrbh[0] = ptrbh[1] = 0;
+	ptrbh[0] = ptrbh[1] = NULL;
 
 	if ( isofs_get_blocks(inode, blockptr >> bufshift, ptrbh, indexblocks) != indexblocks ) {
 		if ( ptrbh[0] ) brelse(ptrbh[0]);
@@ -132,7 +114,7 @@ static int zisofs_readpage(struct file *file, struct page *page)
 			brelse(ptrbh[1]);
 		goto eio;
 	}
-	cstart = le32_to_cpu(*(u32 *)(bh->b_data + (blockptr & bufmask)));
+	cstart = le32_to_cpu(*(__le32 *)(bh->b_data + (blockptr & bufmask)));
 
 	if ( indexblocks == 2 ) {
 		/* We just crossed a block boundary.  Switch to the next block */
@@ -144,11 +126,17 @@ static int zisofs_readpage(struct file *file, struct page *page)
 			goto eio;
 		}
 	}
-	cend = le32_to_cpu(*(u32 *)(bh->b_data + (blockendptr & bufmask)));
+	cend = le32_to_cpu(*(__le32 *)(bh->b_data + (blockendptr & bufmask)));
 	brelse(bh);
 
+	if (cstart > cend)
+		goto eio;
+		
 	csize = cend-cstart;
 
+	if (csize > deflateBound(1UL << zisofs_block_shift))
+		goto eio;
+
 	/* Now page[] contains an array of pages, any of which can be NULL,
 	   and the locks on which we hold.  We should now read the data and
 	   release the pages.  If the pages are NULL the decompressed data