]> git.ipfire.org Git - thirdparty/util-linux.git/commitdiff
libblkid: prevent OOB access while probing HFS+
authorTobias Stoeckmann <tobias@stoeckmann.org>
Wed, 15 Mar 2017 21:12:00 +0000 (22:12 +0100)
committerKarel Zak <kzak@redhat.com>
Thu, 23 Mar 2017 14:46:36 +0000 (15:46 +0100)
It is possible to perform out of boundary read accesses due to
insufficient boundary checks in probe_hfsplus.

The first issue occurs if the leaf count in a B-node is too
small. The second happens while parsing a unicode description which
is longer than 255 UTF-8 characters. The length is stored in a 16 bit
integer, but the array in the struct is limited to 255 * 2, which is
in sync with Apple's Open Source HFS+ implementation (HFSUniStr255).

Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
libblkid/src/superblocks/hfs.c

index ee502cf61f0d12cbba5d6a622c5837511fd04398..ef746d4e2934550ad26e462ca31017337c3b1d00 100644 (file)
@@ -244,7 +244,8 @@ static int probe_hfsplus(blkid_probe pr, const struct blkid_idmag *mag)
        leaf_node_head = be32_to_cpu(bnode->leaf_head);
        leaf_node_size = be16_to_cpu(bnode->node_size);
        leaf_node_count = be32_to_cpu(bnode->leaf_count);
-       if (leaf_node_count == 0)
+       if (leaf_node_size < sizeof(struct hfsplus_bnode_descriptor) +
+           sizeof(struct hfsplus_catalog_key) || leaf_node_count == 0)
                return 0;
 
        leaf_block = (leaf_node_head * leaf_node_size) / blocksize;
@@ -284,7 +285,8 @@ static int probe_hfsplus(blkid_probe pr, const struct blkid_idmag *mag)
        key = (struct hfsplus_catalog_key *)
                &buf[sizeof(struct hfsplus_bnode_descriptor)];
 
-       if (be32_to_cpu(key->parent_id) != HFSPLUS_POR_CNID)
+       if (be32_to_cpu(key->parent_id) != HFSPLUS_POR_CNID ||
+           be16_to_cpu(key->unicode_len > 255))
                return 0;
 
        blkid_probe_set_utf8label(pr, key->unicode,