Date: Tue, 07 Apr 2026 15:52:50 +0000 From: Dag-Erling=?utf-8?Q? Sm=C3=B8rg?=rav <des@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Subject: git: 818243722f6e - stable/14 - cd9660: Add length checks to Rock Ridge parser Message-ID: <69d52852.456a2.6ea479a6@gitrepo.freebsd.org>
index | next in thread | raw e-mail
The branch stable/14 has been updated by des: URL: https://cgit.FreeBSD.org/src/commit/?id=818243722f6ef4e08bff05a7d3f38984fb758506 commit 818243722f6ef4e08bff05a7d3f38984fb758506 Author: Dag-Erling Smørgrav <des@FreeBSD.org> AuthorDate: 2026-04-01 17:14:16 +0000 Commit: Dag-Erling Smørgrav <des@FreeBSD.org> CommitDate: 2026-04-07 15:52:41 +0000 cd9660: Add length checks to Rock Ridge parser * cd9660_rrip_slink() did not check that the lengths of individual entries do not exceed the length of the overall record. * cd9660_rrip_altname() did not check that the length of the record was at least 5 before subtracting 5 from it. Note that in both cases, a better solution would be to check the length of the data before calling the handler, or immediately upon entry of the handler, but this would require significant refactoring. MFC after: 1 week Reported by: Calif.io in collaboration with Claude and Anthropic Research Reported by: Adam Crosser, Praetorian Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D56215 (cherry picked from commit d0afead876076f605c363f03d92304d1bd75be1c) --- sys/fs/cd9660/cd9660_rrip.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/sys/fs/cd9660/cd9660_rrip.c b/sys/fs/cd9660/cd9660_rrip.c index d3b8ccab16ae..28bf7fd3a097 100644 --- a/sys/fs/cd9660/cd9660_rrip.c +++ b/sys/fs/cd9660/cd9660_rrip.c @@ -178,6 +178,8 @@ cd9660_rrip_slink(ISO_RRIP_SLINK *p, ISO_RRIP_ANALYZE *ana) /* Inserting component */ wlen = isonum_711(pcomp->clen); inbuf = pcomp->name; + if (inbuf + wlen > (char *)pcompe) + wlen = ana->maxlen + 1; break; default: printf("RRIP with incorrect flags?"); @@ -249,6 +251,8 @@ cd9660_rrip_altname(ISO_RRIP_ALTNAME *p, ISO_RRIP_ANALYZE *ana) /* Inserting component */ wlen = isonum_711(p->h.length) - 5; inbuf = (char *)p + 5; + if (wlen < 0) + wlen = ana->maxlen + 1; break; default:home | help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?69d52852.456a2.6ea479a6>