isofs: Fix off-by-one in 'session' mount option parsing

According to ECMA-130 standard maximum valid track number is 99. Since
'session' mount option starts indexing at 0 (and we add 1 to the passed
number), we should refuse value 99. Also the condition in
isofs_get_last_session() unnecessarily repeats the check - remove it.

Reported-by: David Howells <dhowells@redhat.com>
Signed-off-by: Jan Kara <jack@suse.cz>

diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
index 8cf898a59730dff80eec216b069cd415fbd5ca70..217a5e7815da6a896daeddb53d8200dcba56a303 100644 (file)
--- a/fs/isofs/inode.c
+++ b/fs/isofs/inode.c
@@ -410,7 +410,11 @@ static int parse_options(char *options, struct iso9660_options *popt)
                        if (match_int(&args[0], &option))
                                return 0;
                        n = option;
-                       if (n > 99)
+                       /*
+                        * Track numbers are supposed to be in range 1-99, the
+                        * mount option starts indexing at 0.
+                        */
+                       if (n >= 99)
                                return 0;
                        popt->session = n + 1;
                        break;
@@ -543,7 +547,7 @@ static unsigned int isofs_get_last_session(struct super_block *sb, s32 session)
 
        vol_desc_start=0;
        ms_info.addr_format=CDROM_LBA;
-       if(session >= 0 && session <= 99) {
+       if (session > 0) {
                struct cdrom_tocentry Te;
                Te.cdte_track=session;
                Te.cdte_format=CDROM_LBA;