mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2026-08-28 02:53:16 -04:00
43a163494f
skip() ignores do_read()'s return value and unconditionally subtracts the requested chunk size from 'size' on every iteration. This was previously bounded by size being 'int': a maliciously large 64-bit value was truncated on assignment, capping the loop early by accident. Now that size is size_t, a crafted file supplying a very large size causes skip() to keep requesting BUFSIZ-sized reads and subtracting BUFSIZ from size regardless of whether do_read() actually succeeds, spinning indefinitely even after EOF or a read error. Check do_read()'s return value and break out of the loop on failure or EOF, so forward progress is only counted when a read actually succeeds. Signed-off-by: Tanushree Shah <tshah@linux.ibm.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>