diff options
| author | Michael Small <smallm@sdf.org> | 2019-02-08 17:01:43 -0500 |
|---|---|---|
| committer | Brian C. Lane <bcl@redhat.com> | 2019-04-09 15:03:19 -0700 |
| commit | 0568d156ea9d06670461f5dfc5d2077f587de8db (patch) | |
| tree | 981f51a4e82723b5438b757c42f464a0609499d5 | |
| parent | 23866318ff15188d784a81b99ed6eeb618254577 (diff) | |
| download | parted-0568d156ea9d06670461f5dfc5d2077f587de8db.tar.gz | |
Avoid sigsegv in case 2nd nilfs2 superblock magic accidently found.
1. is_valid_nilfs_sb: make sure the subtraction bytes - sumoff - 4
won't give a negative number. That as the len argument to
__efi_crc32() would give a very large number for the latter's for
loop limit, since len is unsigned long.
2. nilfs2_probe: Read and allocate enough sectors to hold a
struct nilfs2_super_block. is_valid_nilfs_sb() will be passing
up to 1024 bytes to __efi_crc32(). If only one 512 byte sector
had been allocated with alloca and read from disk that would cause
reads off the the end of the stack even if bytes were more than
sumoff - 4.
Signed-off-by: Brian C. Lane <bcl@redhat.com>
| -rw-r--r-- | libparted/fs/nilfs2/nilfs2.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/libparted/fs/nilfs2/nilfs2.c b/libparted/fs/nilfs2/nilfs2.c index b42a464..52f757c 100644 --- a/libparted/fs/nilfs2/nilfs2.c +++ b/libparted/fs/nilfs2/nilfs2.c @@ -89,7 +89,7 @@ is_valid_nilfs_sb(struct nilfs2_super_block *sb) return 0; bytes = PED_LE16_TO_CPU(sb->s_bytes); - if (bytes > 1024) + if (bytes > 1024 || bytes < sumoff - 4) return 0; crc = __efi_crc32(sb, sumoff, PED_LE32_TO_CPU(sb->s_crc_seed)); @@ -113,11 +113,13 @@ nilfs2_probe (PedGeometry* geom) const int sectors = (4096 + geom->dev->sector_size - 1) / geom->dev->sector_size; char *buf = alloca (sectors * geom->dev->sector_size); - void *buff2 = alloca (geom->dev->sector_size); + const int sectors2 = (1024 + geom->dev->sector_size -1 ) / + geom->dev->sector_size; + void *buff2 = alloca (sectors2 * geom->dev->sector_size); if (ped_geometry_read(geom, buf, 0, sectors)) sb = (struct nilfs2_super_block *)(buf+1024); - if (ped_geometry_read(geom, buff2, sb2off, 1)) + if (ped_geometry_read(geom, buff2, sb2off, sectors2)) sb2 = buff2; if ((!sb || !is_valid_nilfs_sb(sb)) && |