Module Name: src
Committed By: riastradh
Date: Wed Mar 1 16:21:14 UTC 2023
Modified Files:
src/sys/fs/hfs: libhfs.c libhfs.h
Log Message:
fs/hfs: Avoid buffer overrun in hfslib_reada_node_offsets.
XXX pullup-8
XXX pullup-9
XXX pullup-10
To generate a diff of this commit:
cvs rdiff -u -r1.15 -r1.16 src/sys/fs/hfs/libhfs.c
cvs rdiff -u -r1.8 -r1.9 src/sys/fs/hfs/libhfs.h
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/fs/hfs/libhfs.c
diff -u src/sys/fs/hfs/libhfs.c:1.15 src/sys/fs/hfs/libhfs.c:1.16
--- src/sys/fs/hfs/libhfs.c:1.15 Sun Dec 30 22:40:00 2018
+++ src/sys/fs/hfs/libhfs.c Wed Mar 1 16:21:14 2023
@@ -1,4 +1,4 @@
-/* $NetBSD: libhfs.c,v 1.15 2018/12/30 22:40:00 sevan Exp $ */
+/* $NetBSD: libhfs.c,v 1.16 2023/03/01 16:21:14 riastradh Exp $ */
/*-
* Copyright (c) 2005, 2007 The NetBSD Foundation, Inc.
@@ -47,7 +47,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: libhfs.c,v 1.15 2018/12/30 22:40:00 sevan Exp $");
+__KERNEL_RCSID(0, "$NetBSD: libhfs.c,v 1.16 2023/03/01 16:21:14 riastradh Exp $");
#include "libhfs.h"
@@ -1477,7 +1477,7 @@ hfslib_reada_node(void* in_bytes,
HFS_LIBERR("could not allocate node records");
last_bytes_read = hfslib_reada_node_offsets((uint8_t*)in_bytes + nodesize -
- numrecords * sizeof(uint16_t), rec_offsets);
+ numrecords * sizeof(uint16_t), rec_offsets, numrecords);
if (last_bytes_read == 0)
HFS_LIBERR("could not read node record offsets");
@@ -1566,7 +1566,8 @@ exit:
* in reverse order. Does not read the free space offset.
*/
size_t
-hfslib_reada_node_offsets(void* in_bytes, uint16_t* out_offset_array)
+hfslib_reada_node_offsets(void* in_bytes, uint16_t* out_offset_array,
+ uint16_t numrecords)
{
void* ptr;
@@ -1583,6 +1584,8 @@ hfslib_reada_node_offsets(void* in_bytes
*/
out_offset_array--;
do {
+ if (numrecords-- == 0)
+ return 0;
out_offset_array++;
*out_offset_array = be16tohp(&ptr);
} while (*out_offset_array != (uint16_t)14);
Index: src/sys/fs/hfs/libhfs.h
diff -u src/sys/fs/hfs/libhfs.h:1.8 src/sys/fs/hfs/libhfs.h:1.9
--- src/sys/fs/hfs/libhfs.h:1.8 Sat Jan 5 10:25:11 2019
+++ src/sys/fs/hfs/libhfs.h Wed Mar 1 16:21:14 2023
@@ -1,4 +1,4 @@
-/* $NetBSD: libhfs.h,v 1.8 2019/01/05 10:25:11 maya Exp $ */
+/* $NetBSD: libhfs.h,v 1.9 2023/03/01 16:21:14 riastradh Exp $ */
/*-
* Copyright (c) 2005, 2007 The NetBSD Foundation, Inc.
@@ -585,7 +585,7 @@ size_t hfslib_read_master_directory_bloc
hfs_hfs_master_directory_block_t*);
size_t hfslib_reada_node(void*, hfs_node_descriptor_t*, void***, uint16_t**,
hfs_btree_file_type, hfs_volume*, hfs_callback_args*);
-size_t hfslib_reada_node_offsets(void*, uint16_t*);
+size_t hfslib_reada_node_offsets(void*, uint16_t*, uint16_t);
size_t hfslib_read_header_node(void**, uint16_t*, uint16_t,
hfs_header_record_t*, void*, void*);
size_t hfslib_read_catalog_keyed_record(void*, hfs_catalog_keyed_record_t*,
