mirror of
https://github.com/brain-hackers/u-boot-brain
synced 2024-06-09 23:36:03 +09:00
CVE-2019-13103: disk: stop infinite recursion in DOS Partitions
part_get_info_extended and print_partition_extended can recurse infinitely while parsing a self-referential filesystem or one with a silly number of extended partitions. This patch adds a limit to the number of recursive partitions. Signed-off-by: Paul Emge <paulemge@forallsecure.com>
This commit is contained in:
parent
1493b140e4
commit
232e2f4fd9
|
@ -23,6 +23,10 @@
|
||||||
|
|
||||||
#define DOS_PART_DEFAULT_SECTOR 512
|
#define DOS_PART_DEFAULT_SECTOR 512
|
||||||
|
|
||||||
|
/* should this be configurable? It looks like it's not very common at all
|
||||||
|
* to use large numbers of partitions */
|
||||||
|
#define MAX_EXT_PARTS 256
|
||||||
|
|
||||||
/* Convert char[4] in little endian format to the host format integer
|
/* Convert char[4] in little endian format to the host format integer
|
||||||
*/
|
*/
|
||||||
static inline unsigned int le32_to_int(unsigned char *le32)
|
static inline unsigned int le32_to_int(unsigned char *le32)
|
||||||
|
@ -126,6 +130,13 @@ static void print_partition_extended(struct blk_desc *dev_desc,
|
||||||
dos_partition_t *pt;
|
dos_partition_t *pt;
|
||||||
int i;
|
int i;
|
||||||
|
|
||||||
|
/* set a maximum recursion level */
|
||||||
|
if (part_num > MAX_EXT_PARTS)
|
||||||
|
{
|
||||||
|
printf("** Nested DOS partitions detected, stopping **\n");
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
if (blk_dread(dev_desc, ext_part_sector, 1, (ulong *)buffer) != 1) {
|
if (blk_dread(dev_desc, ext_part_sector, 1, (ulong *)buffer) != 1) {
|
||||||
printf ("** Can't read partition table on %d:" LBAFU " **\n",
|
printf ("** Can't read partition table on %d:" LBAFU " **\n",
|
||||||
dev_desc->devnum, ext_part_sector);
|
dev_desc->devnum, ext_part_sector);
|
||||||
|
@ -191,6 +202,13 @@ static int part_get_info_extended(struct blk_desc *dev_desc,
|
||||||
int i;
|
int i;
|
||||||
int dos_type;
|
int dos_type;
|
||||||
|
|
||||||
|
/* set a maximum recursion level */
|
||||||
|
if (part_num > MAX_EXT_PARTS)
|
||||||
|
{
|
||||||
|
printf("** Nested DOS partitions detected, stopping **\n");
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
|
||||||
if (blk_dread(dev_desc, ext_part_sector, 1, (ulong *)buffer) != 1) {
|
if (blk_dread(dev_desc, ext_part_sector, 1, (ulong *)buffer) != 1) {
|
||||||
printf ("** Can't read partition table on %d:" LBAFU " **\n",
|
printf ("** Can't read partition table on %d:" LBAFU " **\n",
|
||||||
dev_desc->devnum, ext_part_sector);
|
dev_desc->devnum, ext_part_sector);
|
||||||
|
|
Loading…
Reference in New Issue
Block a user