Date: Fri, 4 Aug 2023 23:43:06 GMT From: John Baldwin <jhb@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Subject: git: c70e615051b0 - main - udf: Reject read requests with an invalid length Message-ID: <202308042343.374Nh69b059162@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch main has been updated by jhb: URL: https://cgit.FreeBSD.org/src/commit/?id=c70e615051b00671d54651d99af5cdec4b091d92 commit c70e615051b00671d54651d99af5cdec4b091d92 Author: John Baldwin <jhb@FreeBSD.org> AuthorDate: 2023-08-04 23:40:19 +0000 Commit: John Baldwin <jhb@FreeBSD.org> CommitDate: 2023-08-04 23:40:19 +0000 udf: Reject read requests with an invalid length - If the size is negative or if rounding it up to a multiple of the block size overflows, fail the read request with ERANGE. - While here, add a sanity check that the ICB length for the root directory is at least as long as a minimum-sized file entry. PR: 257768 Reported by: Robert Morris <rtm@lcs.mit.edu> MFC after: 1 week Sponsored by: FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D41220 --- sys/fs/udf/udf.h | 4 +++- sys/fs/udf/udf_vfsops.c | 5 +++++ 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/sys/fs/udf/udf.h b/sys/fs/udf/udf.h index b210427a63d7..8500088ec9b7 100644 --- a/sys/fs/udf/udf.h +++ b/sys/fs/udf/udf.h @@ -97,8 +97,10 @@ struct ifid { MALLOC_DECLARE(M_UDFFENTRY); static __inline int -udf_readdevblks(struct udf_mnt *udfmp, int sector, int size, struct buf **bp) +udf_readdevblks(struct udf_mnt *udfmp, daddr_t sector, int size, struct buf **bp) { + if (size < 0 || size + udfmp->bmask < size) + return (ERANGE); return (RDSECTOR(udfmp->im_devvp, sector, (size + udfmp->bmask) & ~udfmp->bmask, bp)); } diff --git a/sys/fs/udf/udf_vfsops.c b/sys/fs/udf/udf_vfsops.c index a8aa811a0d6c..b0a221df6391 100644 --- a/sys/fs/udf/udf_vfsops.c +++ b/sys/fs/udf/udf_vfsops.c @@ -482,6 +482,11 @@ udf_mountfs(struct vnode *devvp, struct mount *mp) */ sector = le32toh(udfmp->root_icb.loc.lb_num) + udfmp->part_start; size = le32toh(udfmp->root_icb.len); + if (size < UDF_FENTRY_SIZE) { + printf("Invalid root directory file entry length %u\n", + size); + goto bail; + } if ((error = udf_readdevblks(udfmp, sector, size, &bp)) != 0) { printf("Cannot read sector %d\n", sector); goto bail;
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202308042343.374Nh69b059162>