v7sb = (struct v7_super_block *) bh->b_data;
if (fs16_to_cpu(sbi, v7sb->s_nfree) > V7_NICFREE ||
fs16_to_cpu(sbi, v7sb->s_ninode) > V7_NICINOD ||
- fs32_to_cpu(sbi, v7sb->s_time) == 0)
+ fs32_to_cpu(sbi, v7sb->s_fsize) > V7_MAXSIZE)
goto failed;
/* plausibility check on root inode: it is a directory,
v7i = (struct sysv_inode *)(bh2->b_data + 64);
if ((fs16_to_cpu(sbi, v7i->i_mode) & ~0777) != S_IFDIR ||
(fs32_to_cpu(sbi, v7i->i_size) == 0) ||
- (fs32_to_cpu(sbi, v7i->i_size) & 017) != 0)
+ (fs32_to_cpu(sbi, v7i->i_size) & 017) ||
+ (fs32_to_cpu(sbi, v7i->i_size) > V7_NFILES *
+ sizeof(struct sysv_dir_entry)))
goto failed;
brelse(bh2);
bh2 = NULL;
char s_fname[6]; /* file system name */
char s_fpack[6]; /* file system pack name */
};
+/* Constants to aid sanity checking */
+/* This is not a hard limit, nor enforced by v7 kernel. It's actually just
+ * the limit used by Seventh Edition's ls, though is high enough to assume
+ * that no reasonable file system would have that much entries in root
+ * directory. Thus, if we see anything higher, we just probably got the
+ * endiannes wrong. */
+#define V7_NFILES 1024
+/* The disk addresses are three-byte (despite direct block addresses being
+ * aligned word-wise in inode). If the most significant byte is non-zero,
+ * something is most likely wrong (not a filesystem, bad bytesex). */
+#define V7_MAXSIZE 0x00ffffff
/* Coherent super-block data on disk */
#define COH_NICINOD 100 /* number of inode cache entries */