isofs: bound empty directory blocks in isofs_read_level3_size()

isofs_read_level3_size() walks the sections of a level-3 (multi-extent)
directory record and, on a zero length byte, moves on to the next
block with no limit.  A crafted image can put a long run of empty
blocks between two sections of a multi-extent file, and the walk reads
every one of them before it gives up, all the way to the end of the
device if it has to.

Real discs do have trailing empty directory blocks, written by tools
such as Easy CD Creator and Nero, but always at the end of the
directory, never between two sections of a multi-extent record, so
they do not exercise this path [1].

Jan Kara suggested treating an empty block like a section: count it
towards the existing 100-section limit rather than adding a separate
one [2].  Do that: both the section count and the empty-block count
are checked against their combined total, so neither one alone can
reach 100 while the other keeps growing.  Only a zero length byte at
the start of a block counts as an empty block; the same byte later in
a block still just ends that block's records, as it does today, and
is not counted.

Hui Peng's earlier patch for this function added its own, separate
limit on the number of empty blocks [3]; this uses the combined limit
Jan suggested instead.

Suggested-by: Jan Kara <jack@suse.cz>
Signed-off-by: Matthias Goergens <matthias.goergens@gmail.com>

[1] https://lore.kernel.org/all/20260925043804.2091174-1-matthias.goergens@gmail.com/
[2] https://lore.kernel.org/all/cmlro2xzle2aa7ebflvxhbcv74mea7p6qvxhin6egpdvyzyuxh@s45tpgxdal3n/
[3] https://lore.kernel.org/all/20260919222553.3792320-1-benquike@gmail.com/

Link: https://patch.msgid.link/20260926083517.556576-1-matthias.goergens@gmail.com
Signed-off-by: Jan Kara <jack@suse.cz>

0 files changed, 0 insertions, 0 deletions