Skip to content

Commit

Permalink
fs/squashfs: sqfs_read: remove buggy offset functionality
Browse files Browse the repository at this point in the history
offset is the offset in the file read, not the offset in the destination
buffer.
If the offset is not null, this will lead to a memory corruption.
So, for now, we are returning an error if the offset is used.

Signed-off-by: Richard Genoud <richard.genoud@posteo.net>
  • Loading branch information
Richard Genoud authored and trini committed Nov 19, 2020
1 parent cbd5e40 commit 21b1b3b
Showing 1 changed file with 12 additions and 4 deletions.
16 changes: 12 additions & 4 deletions fs/squashfs/sqfs.c
Original file line number Diff line number Diff line change
Expand Up @@ -1326,6 +1326,14 @@ int sqfs_read(const char *filename, void *buf, loff_t offset, loff_t len,

*actread = 0;

if (offset) {
/*
* TODO: implement reading at an offset in file
*/
printf("Error: reading at a specific offset in a squashfs file is not supported yet.\n");
return -EINVAL;
}

/*
* sqfs_opendir will uncompress inode and directory tables, and will
* return a pointer to the directory that contains the requested file.
Expand Down Expand Up @@ -1465,12 +1473,12 @@ int sqfs_read(const char *filename, void *buf, loff_t offset, loff_t len,

if ((*actread + dest_len) > len)
dest_len = len - *actread;
memcpy(buf + offset + *actread, datablock, dest_len);
memcpy(buf + *actread, datablock, dest_len);
*actread += dest_len;
} else {
if ((*actread + table_size) > len)
table_size = len - *actread;
memcpy(buf + offset + *actread, data, table_size);
memcpy(buf + *actread, data, table_size);
*actread += table_size;
}

Expand Down Expand Up @@ -1522,7 +1530,7 @@ int sqfs_read(const char *filename, void *buf, loff_t offset, loff_t len,
goto out;
}

for (j = offset + *actread; j < finfo.size; j++) {
for (j = *actread; j < finfo.size; j++) {
memcpy(buf + j, &fragment_block[finfo.offset + j], 1);
(*actread)++;
}
Expand All @@ -1532,7 +1540,7 @@ int sqfs_read(const char *filename, void *buf, loff_t offset, loff_t len,
} else if (finfo.frag && !finfo.comp) {
fragment_block = (void *)fragment + table_offset;

for (j = offset + *actread; j < finfo.size; j++) {
for (j = *actread; j < finfo.size; j++) {
memcpy(buf + j, &fragment_block[finfo.offset + j], 1);
(*actread)++;
}
Expand Down

0 comments on commit 21b1b3b

Please sign in to comment.