exec.c, compat.c: fix count(), compat_count() bounds checking

[cascardo/linux.git] / fs / compat.c

diff --git a/fs/compat.c b/fs/compat.c
index c9d1472..aae13d3 100644 (file)
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -792,8 +792,10 @@ static int compat_fillonedir(void *__buf, const char *name, int namlen,
        if (buf->result)
                return -EINVAL;
        d_ino = ino;
-       if (sizeof(d_ino) < sizeof(ino) && d_ino != ino)
+       if (sizeof(d_ino) < sizeof(ino) && d_ino != ino) {
+               buf->result = -EOVERFLOW;
                return -EOVERFLOW;
+       }
        buf->result++;
        dirent = buf->dirent;
        if (!access_ok(VERIFY_WRITE, dirent,
@@ -862,8 +864,10 @@ static int compat_filldir(void *__buf, const char *name, int namlen,
        if (reclen > buf->count)
                return -EINVAL;
        d_ino = ino;
-       if (sizeof(d_ino) < sizeof(ino) && d_ino != ino)
+       if (sizeof(d_ino) < sizeof(ino) && d_ino != ino) {
+               buf->error = -EOVERFLOW;
                return -EOVERFLOW;
+       }
        dirent = buf->previous;
        if (dirent) {
                if (__put_user(offset, &dirent->d_off))
@@ -1235,7 +1239,7 @@ static int compat_count(compat_uptr_t __user *argv, int max)
                        if (!p)
                                break;
                        argv++;
-                       if(++i > max)
+                       if (i++ >= max)
                                return -E2BIG;
                }
        }