fsck.minix: Verify more fields in super-block.

The field s_ninodes in super-block is used for memory allocation and
division without verifications. The memory allocation increments the
unchecked value by 1, making it vulnerable to an integer overflow
on 32 bit systems with minix 3 file systems. I did not find a (good)
way to exploit this by crafting a malicious file system, so I consider
it as a reliability issue. If it's 0, a division by zero occurs when
"-v" has been used. A filesystem without any inodes is definitely
wrong, because it means that there's not even the root inode, which is
accessed unchecked later on.

The field s_firstdatazone has to be checked against s_(n)zones. If it
is larger than the highest allowed index, the file system is definitely
corrupted -- hard to say which value is wrong though, therefore I
decided to simply call die(). A maliciously created file system could
do more harm in this way: single bits inside the memory area could be
flipped because range checks would fail. Hard to consider it as a
security issue though, because these addresses are not arbitrarily
accessible without very careful crafting (if at all possible).

[kzak@redhat.com: - fix compiler warning (cast get_nzones()) [-Wsign-compare]]

Signed-off-by: Karel Zak <kzak@redhat.com>

diff --git a/disk-utils/fsck.minix.c b/disk-utils/fsck.minix.c
index aa64569ff83399bf6b36455ad5190517ac6312e6..be74f81a06c0da8096523c95f4cc9171dd46d4dd 100644 (file)
--- a/disk-utils/fsck.minix.c
+++ b/disk-utils/fsck.minix.c
@@ -573,8 +573,12 @@ read_superblock(void) {
                die(_("bad magic number in super-block"));
        if (get_zone_size() != 0 || MINIX_BLOCK_SIZE != 1024)
                die(_("Only 1k blocks/zones supported"));
+       if (get_ninodes() == 0 || get_ninodes() == UINT32_MAX)
+               die(_("bad s_ninodes field in super-block"));
        if (get_nimaps() * MINIX_BLOCK_SIZE * 8 < get_ninodes() + 1)
                die(_("bad s_imap_blocks field in super-block"));
+       if (get_first_zone() > (off_t) get_nzones())
+               die(_("bad s_firstdatazone field in super-block"));
        if (get_nzmaps() * MINIX_BLOCK_SIZE * 8 <
            get_nzones() - get_first_zone() + 1)
                die(_("bad s_zmap_blocks field in super-block"));