loop: fix NULL dereference if mount fails

[safe/jmp/linux-2.6] / fs / isofs / namei.c

diff --git a/fs/isofs/namei.c b/fs/isofs/namei.c
index c8c7e51..eaa8313 100644 (file)
--- a/fs/isofs/namei.c
+++ b/fs/isofs/namei.c
@@ -111,6 +111,13 @@ isofs_find_entry(struct inode *dir, struct dentry *dentry,
 
                dlen = de->name_len[0];
                dpnt = de->name;
+               /* Basic sanity check, whether name doesn't exceed dir entry */
+               if (de_len < dlen + sizeof(struct iso_directory_record)) {
+                       printk(KERN_NOTICE "iso9660: Corrupted directory entry"
+                              " in block %lu of inode %lu\n", block,
+                              dir->i_ino);
+                       return 0;
+               }
 
                if (sbi->s_rock &&
                    ((i = get_rock_ridge_filename(de, tmpname, dir)))) {
@@ -135,9 +142,9 @@ isofs_find_entry(struct inode *dir, struct dentry *dentry,
                 */
                match = 0;
                if (dlen > 0 &&
-                       (sbi->s_hide =='n' ||
+                       (!sbi->s_hide ||
                                (!(de->flags[-sbi->s_high_sierra] & 1))) &&
-                       (sbi->s_showassoc =='y' ||
+                       (sbi->s_showassoc ||
                                (!(de->flags[-sbi->s_high_sierra] & 4)))) {
                        match = (isofs_cmp(dentry, dpnt, dlen) == 0);
                }
@@ -158,7 +165,8 @@ isofs_find_entry(struct inode *dir, struct dentry *dentry,
 struct dentry *isofs_lookup(struct inode *dir, struct dentry *dentry, struct nameidata *nd)
 {
        int found;
-       unsigned long block, offset;
+       unsigned long uninitialized_var(block);
+       unsigned long uninitialized_var(offset);
        struct inode *inode;
        struct page *page;
 
@@ -178,9 +186,9 @@ struct dentry *isofs_lookup(struct inode *dir, struct dentry *dentry, struct nam
        inode = NULL;
        if (found) {
                inode = isofs_iget(dir->i_sb, block, offset);
-               if (!inode) {
+               if (IS_ERR(inode)) {
                        unlock_kernel();
-                       return ERR_PTR(-EACCES);
+                       return ERR_CAST(inode);
                }
        }
        unlock_kernel();