The field length check should check for field overflow.
---
 isofs/rr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/isofs/rr.c b/isofs/rr.c
index 4cd97924..b6d85446 100644
--- a/isofs/rr.c
+++ b/isofs/rr.c
@@ -192,7 +192,7 @@ rrip_work (struct dirrect *dr, struct rrip_lookup *rr,

          /* Make sure the ER field is valid */
          if ((void *) er->more + er->len_id + er->len_des + er->len_src
-             < terminus)
+             > terminus)
            goto next_field;

          /* Check for rock-ridge */

Reply via email to