From: Jan Kara <jack@suse.cz>
Date: Fri, 12 Jun 2026 11:50:04 +0000 (+0200)
Subject: udf: validate VAT inode size for old VAT format
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5163e6ee1ea744d412fe516235bfd9cab15141dc;p=thirdparty%2Flinux.git

udf: validate VAT inode size for old VAT format

Validate VAT inode is large enough to contain at least the header for
pre-2.00 UDF media format.

Signed-off-by: Jan Kara <jack@suse.cz>
---

diff --git a/fs/udf/super.c b/fs/udf/super.c
index 1b5282790de6f..c7110d26d6fe7 100644
--- a/fs/udf/super.c
+++ b/fs/udf/super.c
@@ -1242,6 +1242,11 @@ static int udf_load_vat(struct super_block *sb, int p_index, int type1_index)
 
 	if (map->s_partition_type == UDF_VIRTUAL_MAP15) {
 		map->s_type_specific.s_virtual.s_start_offset = 0;
+		if (sbi->s_vat_inode->i_size < 36) {
+			udf_err(sb, "Too short VAT inode size %lld\n",
+				sbi->s_vat_inode->i_size);
+			return -EFSCORRUPTED;
+		}
 		map->s_type_specific.s_virtual.s_num_entries =
 			(sbi->s_vat_inode->i_size - 36) >> 2;
 	} else if (map->s_partition_type == UDF_VIRTUAL_MAP20) {