Module Name: src Committed By: riastradh Date: Wed Mar 1 16:21:14 UTC 2023
Modified Files: src/sys/fs/hfs: libhfs.c libhfs.h Log Message: fs/hfs: Avoid buffer overrun in hfslib_reada_node_offsets. XXX pullup-8 XXX pullup-9 XXX pullup-10 To generate a diff of this commit: cvs rdiff -u -r1.15 -r1.16 src/sys/fs/hfs/libhfs.c cvs rdiff -u -r1.8 -r1.9 src/sys/fs/hfs/libhfs.h Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
Modified files: Index: src/sys/fs/hfs/libhfs.c diff -u src/sys/fs/hfs/libhfs.c:1.15 src/sys/fs/hfs/libhfs.c:1.16 --- src/sys/fs/hfs/libhfs.c:1.15 Sun Dec 30 22:40:00 2018 +++ src/sys/fs/hfs/libhfs.c Wed Mar 1 16:21:14 2023 @@ -1,4 +1,4 @@ -/* $NetBSD: libhfs.c,v 1.15 2018/12/30 22:40:00 sevan Exp $ */ +/* $NetBSD: libhfs.c,v 1.16 2023/03/01 16:21:14 riastradh Exp $ */ /*- * Copyright (c) 2005, 2007 The NetBSD Foundation, Inc. @@ -47,7 +47,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: libhfs.c,v 1.15 2018/12/30 22:40:00 sevan Exp $"); +__KERNEL_RCSID(0, "$NetBSD: libhfs.c,v 1.16 2023/03/01 16:21:14 riastradh Exp $"); #include "libhfs.h" @@ -1477,7 +1477,7 @@ hfslib_reada_node(void* in_bytes, HFS_LIBERR("could not allocate node records"); last_bytes_read = hfslib_reada_node_offsets((uint8_t*)in_bytes + nodesize - - numrecords * sizeof(uint16_t), rec_offsets); + numrecords * sizeof(uint16_t), rec_offsets, numrecords); if (last_bytes_read == 0) HFS_LIBERR("could not read node record offsets"); @@ -1566,7 +1566,8 @@ exit: * in reverse order. Does not read the free space offset. */ size_t -hfslib_reada_node_offsets(void* in_bytes, uint16_t* out_offset_array) +hfslib_reada_node_offsets(void* in_bytes, uint16_t* out_offset_array, + uint16_t numrecords) { void* ptr; @@ -1583,6 +1584,8 @@ hfslib_reada_node_offsets(void* in_bytes */ out_offset_array--; do { + if (numrecords-- == 0) + return 0; out_offset_array++; *out_offset_array = be16tohp(&ptr); } while (*out_offset_array != (uint16_t)14); Index: src/sys/fs/hfs/libhfs.h diff -u src/sys/fs/hfs/libhfs.h:1.8 src/sys/fs/hfs/libhfs.h:1.9 --- src/sys/fs/hfs/libhfs.h:1.8 Sat Jan 5 10:25:11 2019 +++ src/sys/fs/hfs/libhfs.h Wed Mar 1 16:21:14 2023 @@ -1,4 +1,4 @@ -/* $NetBSD: libhfs.h,v 1.8 2019/01/05 10:25:11 maya Exp $ */ +/* $NetBSD: libhfs.h,v 1.9 2023/03/01 16:21:14 riastradh Exp $ */ /*- * Copyright (c) 2005, 2007 The NetBSD Foundation, Inc. @@ -585,7 +585,7 @@ size_t hfslib_read_master_directory_bloc hfs_hfs_master_directory_block_t*); size_t hfslib_reada_node(void*, hfs_node_descriptor_t*, void***, uint16_t**, hfs_btree_file_type, hfs_volume*, hfs_callback_args*); -size_t hfslib_reada_node_offsets(void*, uint16_t*); +size_t hfslib_reada_node_offsets(void*, uint16_t*, uint16_t); size_t hfslib_read_header_node(void**, uint16_t*, uint16_t, hfs_header_record_t*, void*, void*); size_t hfslib_read_catalog_keyed_record(void*, hfs_catalog_keyed_record_t*,