ericonr
/
util-linux
mirror of https://github.com/ericonr/util-linux.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

libblkid: prevent OOB access while probing HFS+ 

It is possible to perform out of boundary read accesses due to
insufficient boundary checks in probe_hfsplus.

The first issue occurs if the leaf count in a B-node is too
small. The second happens while parsing a unicode description which
is longer than 255 UTF-8 characters. The length is stored in a 16 bit
integer, but the array in the struct is limited to 255 * 2, which is
in sync with Apple's Open Source HFS+ implementation (HFSUniStr255).

Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
This commit is contained in:
Tobias Stoeckmann 2017-03-15 22:12:00 +01:00 committed by Karel Zak
parent eef0a92d31
commit 62ab1ebb12
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libblkid/src/superblocks/hfs.c
View File

@ -244,7 +244,8 @@ static int probe_hfsplus(blkid_probe pr, const struct blkid_idmag *mag)
leaf_node_head = be32_to_cpu(bnode->leaf_head);
leaf_node_size = be16_to_cpu(bnode->node_size);
leaf_node_count = be32_to_cpu(bnode->leaf_count);
if (leaf_node_count == 0)
if (leaf_node_size < sizeof(struct hfsplus_bnode_descriptor) +
sizeof(struct hfsplus_catalog_key) || leaf_node_count == 0)
return 0;
leaf_block = (leaf_node_head * leaf_node_size) / blocksize;
@ -284,7 +285,8 @@ static int probe_hfsplus(blkid_probe pr, const struct blkid_idmag *mag)
key = (struct hfsplus_catalog_key *)
&buf[sizeof(struct hfsplus_bnode_descriptor)];
if (be32_to_cpu(key->parent_id) != HFSPLUS_POR_CNID)
if (be32_to_cpu(key->parent_id) != HFSPLUS_POR_CNID ||
be16_to_cpu(key->unicode_len > 255))
return 0;
blkid_probe_set_utf8label(pr, key->unicode,