libblkid: prevent OOB access while probing HFS+
It is possible to perform out of boundary read accesses due to insufficient boundary checks in probe_hfsplus. The first issue occurs if the leaf count in a B-node is too small. The second happens while parsing a unicode description which is longer than 255 UTF-8 characters. The length is stored in a 16 bit integer, but the array in the struct is limited to 255 * 2, which is in sync with Apple's Open Source HFS+ implementation (HFSUniStr255). Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
This commit is contained in:
parent
eef0a92d31
commit
62ab1ebb12
|
@ -244,7 +244,8 @@ static int probe_hfsplus(blkid_probe pr, const struct blkid_idmag *mag)
|
|||
leaf_node_head = be32_to_cpu(bnode->leaf_head);
|
||||
leaf_node_size = be16_to_cpu(bnode->node_size);
|
||||
leaf_node_count = be32_to_cpu(bnode->leaf_count);
|
||||
if (leaf_node_count == 0)
|
||||
if (leaf_node_size < sizeof(struct hfsplus_bnode_descriptor) +
|
||||
sizeof(struct hfsplus_catalog_key) || leaf_node_count == 0)
|
||||
return 0;
|
||||
|
||||
leaf_block = (leaf_node_head * leaf_node_size) / blocksize;
|
||||
|
@ -284,7 +285,8 @@ static int probe_hfsplus(blkid_probe pr, const struct blkid_idmag *mag)
|
|||
key = (struct hfsplus_catalog_key *)
|
||||
&buf[sizeof(struct hfsplus_bnode_descriptor)];
|
||||
|
||||
if (be32_to_cpu(key->parent_id) != HFSPLUS_POR_CNID)
|
||||
if (be32_to_cpu(key->parent_id) != HFSPLUS_POR_CNID ||
|
||||
be16_to_cpu(key->unicode_len > 255))
|
||||
return 0;
|
||||
|
||||
blkid_probe_set_utf8label(pr, key->unicode,
|
||||
|
|
Loading…
Reference in New Issue