xnu-1504.9.37.tar.gz

[apple/xnu.git] / bsd / hfs / hfs_readwrite.c

diff --git a/bsd/hfs/hfs_readwrite.c b/bsd/hfs/hfs_readwrite.c
index 97578830da10d984f4270e50b54825fef5df0448..9fcd6a02d59b71fd1975fb22b2271aaba7157fd2 100644 (file)
--- a/bsd/hfs/hfs_readwrite.c
+++ b/bsd/hfs/hfs_readwrite.c
@@ -1947,6 +1947,12 @@ fail_change_next_allocation:
                        user_bootstrap.fbt_length = bootstrapp->fbt_length;
                        user_bootstrap.fbt_buffer = CAST_USER_ADDR_T(bootstrapp->fbt_buffer);
                }
+
+               if ((user_bootstrapp->fbt_offset < 0) || (user_bootstrapp->fbt_offset > 1024) ||
+                               (user_bootstrapp->fbt_length > 1024)) {
+                       return EINVAL;
+               }
+
                if (user_bootstrapp->fbt_offset + user_bootstrapp->fbt_length > 1024) 
                        return EINVAL;