54 lines
2.0 KiB
Diff
54 lines
2.0 KiB
Diff
From b951c46fab0efe29adc43d7fff7ed4201adcde7d Mon Sep 17 00:00:00 2001
|
|
From: Michael Small <smallm@sdf.org>
|
|
Date: Fri, 8 Feb 2019 17:01:43 -0500
|
|
Subject: [PATCH 110/111] Avoid sigsegv in case 2nd nilfs2 superblock magic
|
|
accidently found.
|
|
|
|
1. is_valid_nilfs_sb: make sure the subtraction bytes - sumoff - 4
|
|
won't give a negative number. That as the len argument to
|
|
__efi_crc32() would give a very large number for the latter's for
|
|
loop limit, since len is unsigned long.
|
|
|
|
2. nilfs2_probe: Read and allocate enough sectors to hold a
|
|
struct nilfs2_super_block. is_valid_nilfs_sb() will be passing
|
|
up to 1024 bytes to __efi_crc32(). If only one 512 byte sector
|
|
had been allocated with alloca and read from disk that would cause
|
|
reads off the the end of the stack even if bytes were more than
|
|
sumoff - 4.
|
|
---
|
|
libparted/fs/nilfs2/nilfs2.c | 8 +++++---
|
|
1 file changed, 5 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/libparted/fs/nilfs2/nilfs2.c b/libparted/fs/nilfs2/nilfs2.c
|
|
index b42a464..52f757c 100644
|
|
--- a/libparted/fs/nilfs2/nilfs2.c
|
|
+++ b/libparted/fs/nilfs2/nilfs2.c
|
|
@@ -89,7 +89,7 @@ is_valid_nilfs_sb(struct nilfs2_super_block *sb)
|
|
return 0;
|
|
|
|
bytes = PED_LE16_TO_CPU(sb->s_bytes);
|
|
- if (bytes > 1024)
|
|
+ if (bytes > 1024 || bytes < sumoff - 4)
|
|
return 0;
|
|
|
|
crc = __efi_crc32(sb, sumoff, PED_LE32_TO_CPU(sb->s_crc_seed));
|
|
@@ -113,11 +113,13 @@ nilfs2_probe (PedGeometry* geom)
|
|
const int sectors = (4096 + geom->dev->sector_size - 1) /
|
|
geom->dev->sector_size;
|
|
char *buf = alloca (sectors * geom->dev->sector_size);
|
|
- void *buff2 = alloca (geom->dev->sector_size);
|
|
+ const int sectors2 = (1024 + geom->dev->sector_size -1 ) /
|
|
+ geom->dev->sector_size;
|
|
+ void *buff2 = alloca (sectors2 * geom->dev->sector_size);
|
|
|
|
if (ped_geometry_read(geom, buf, 0, sectors))
|
|
sb = (struct nilfs2_super_block *)(buf+1024);
|
|
- if (ped_geometry_read(geom, buff2, sb2off, 1))
|
|
+ if (ped_geometry_read(geom, buff2, sb2off, sectors2))
|
|
sb2 = buff2;
|
|
|
|
if ((!sb || !is_valid_nilfs_sb(sb)) &&
|
|
--
|
|
2.20.1
|
|
|