diff options
| author | Tobias Stoeckmann | 2017-03-15 22:12:00 +0100 |
|---|---|---|
| committer | Karel Zak | 2017-03-23 15:46:36 +0100 |
| commit | 62ab1ebb12e812b15382318861a594c946b6238e (patch) | |
| tree | eda71c2d086da20d46e4721c3ae6a0d40c8de90d /libblkid | |
| parent | tests: refresh fincore test (diff) | |
| download | kernel-qcow2-util-linux-62ab1ebb12e812b15382318861a594c946b6238e.tar.gz kernel-qcow2-util-linux-62ab1ebb12e812b15382318861a594c946b6238e.tar.xz kernel-qcow2-util-linux-62ab1ebb12e812b15382318861a594c946b6238e.zip | |
libblkid: prevent OOB access while probing HFS+
It is possible to perform out of boundary read accesses due to
insufficient boundary checks in probe_hfsplus.
The first issue occurs if the leaf count in a B-node is too
small. The second happens while parsing a unicode description which
is longer than 255 UTF-8 characters. The length is stored in a 16 bit
integer, but the array in the struct is limited to 255 * 2, which is
in sync with Apple's Open Source HFS+ implementation (HFSUniStr255).
Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
Diffstat (limited to 'libblkid')
| -rw-r--r-- | libblkid/src/superblocks/hfs.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/libblkid/src/superblocks/hfs.c b/libblkid/src/superblocks/hfs.c index ee502cf61..ef746d4e2 100644 --- a/libblkid/src/superblocks/hfs.c +++ b/libblkid/src/superblocks/hfs.c @@ -244,7 +244,8 @@ static int probe_hfsplus(blkid_probe pr, const struct blkid_idmag *mag) leaf_node_head = be32_to_cpu(bnode->leaf_head); leaf_node_size = be16_to_cpu(bnode->node_size); leaf_node_count = be32_to_cpu(bnode->leaf_count); - if (leaf_node_count == 0) + if (leaf_node_size < sizeof(struct hfsplus_bnode_descriptor) + + sizeof(struct hfsplus_catalog_key) || leaf_node_count == 0) return 0; leaf_block = (leaf_node_head * leaf_node_size) / blocksize; @@ -284,7 +285,8 @@ static int probe_hfsplus(blkid_probe pr, const struct blkid_idmag *mag) key = (struct hfsplus_catalog_key *) &buf[sizeof(struct hfsplus_bnode_descriptor)]; - if (be32_to_cpu(key->parent_id) != HFSPLUS_POR_CNID) + if (be32_to_cpu(key->parent_id) != HFSPLUS_POR_CNID || + be16_to_cpu(key->unicode_len > 255)) return 0; blkid_probe_set_utf8label(pr, key->unicode, |