diff options
| author | Paul Emge <paulemge@forallsecure.com> | 2019-07-08 16:37:03 -0700 |
|---|---|---|
| committer | Tom Rini <trini@konsulko.com> | 2019-07-18 11:31:28 -0400 |
| commit | 232e2f4fd9a24bf08215ddc8c53ccadffc841fb5 (patch) | |
| tree | 2bde1d5dff61061f52f05ffd2d8fa353484a73c0 | |
| parent | 1493b140e4a9211635964cd1c0276e599405f403 (diff) | |
CVE-2019-13103: disk: stop infinite recursion in DOS Partitions
part_get_info_extended and print_partition_extended can recurse infinitely
while parsing a self-referential filesystem or one with a silly number of
extended partitions. This patch adds a limit to the number of recursive
partitions.
Signed-off-by: Paul Emge <paulemge@forallsecure.com>
| -rw-r--r-- | disk/part_dos.c | 18 |
1 files changed, 18 insertions, 0 deletions
diff --git a/disk/part_dos.c b/disk/part_dos.c index 936cee0d36..aae9d95906 100644 --- a/disk/part_dos.c +++ b/disk/part_dos.c @@ -23,6 +23,10 @@ #define DOS_PART_DEFAULT_SECTOR 512 +/* should this be configurable? It looks like it's not very common at all + * to use large numbers of partitions */ +#define MAX_EXT_PARTS 256 + /* Convert char[4] in little endian format to the host format integer */ static inline unsigned int le32_to_int(unsigned char *le32) @@ -126,6 +130,13 @@ static void print_partition_extended(struct blk_desc *dev_desc, dos_partition_t *pt; int i; + /* set a maximum recursion level */ + if (part_num > MAX_EXT_PARTS) + { + printf("** Nested DOS partitions detected, stopping **\n"); + return; + } + if (blk_dread(dev_desc, ext_part_sector, 1, (ulong *)buffer) != 1) { printf ("** Can't read partition table on %d:" LBAFU " **\n", dev_desc->devnum, ext_part_sector); @@ -191,6 +202,13 @@ static int part_get_info_extended(struct blk_desc *dev_desc, int i; int dos_type; + /* set a maximum recursion level */ + if (part_num > MAX_EXT_PARTS) + { + printf("** Nested DOS partitions detected, stopping **\n"); + return -1; + } + if (blk_dread(dev_desc, ext_part_sector, 1, (ulong *)buffer) != 1) { printf ("** Can't read partition table on %d:" LBAFU " **\n", dev_desc->devnum, ext_part_sector); |