Date: Wed, 01 Apr 2026 17:14:57 +0000 From: Dag-Erling=?utf-8?Q? Sm=C3=B8rg?=rav <des@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Subject: git: d0afead87607 - main - cd9660: Add length checks to Rock Ridge parser Message-ID: <69cd5291.1c22a.1a680901@gitrepo.freebsd.org>
index | next in thread | raw e-mail
The branch main has been updated by des: URL: https://cgit.FreeBSD.org/src/commit/?id=d0afead876076f605c363f03d92304d1bd75be1c commit d0afead876076f605c363f03d92304d1bd75be1c Author: Dag-Erling Smørgrav <des@FreeBSD.org> AuthorDate: 2026-04-01 17:14:16 +0000 Commit: Dag-Erling Smørgrav <des@FreeBSD.org> CommitDate: 2026-04-01 17:14:48 +0000 cd9660: Add length checks to Rock Ridge parser * cd9660_rrip_slink() did not check that the lengths of individual entries do not exceed the length of the overall record. * cd9660_rrip_altname() did not check that the length of the record was at least 5 before subtracting 5 from it. Note that in both cases, a better solution would be to check the length of the data before calling the handler, or immediately upon entry of the handler, but this would require significant refactoring. MFC after: 1 week Reported by: Calif.io in collaboration with Claude and Anthropic Research Reported by: Adam Crosser, Praetorian Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D56215 --- sys/fs/cd9660/cd9660_rrip.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/sys/fs/cd9660/cd9660_rrip.c b/sys/fs/cd9660/cd9660_rrip.c index 6e91f1abb9d2..9bc8ef655368 100644 --- a/sys/fs/cd9660/cd9660_rrip.c +++ b/sys/fs/cd9660/cd9660_rrip.c @@ -175,6 +175,8 @@ cd9660_rrip_slink(ISO_RRIP_SLINK *p, ISO_RRIP_ANALYZE *ana) /* Inserting component */ wlen = isonum_711(pcomp->clen); inbuf = pcomp->name; + if (inbuf + wlen > (char *)pcompe) + wlen = ana->maxlen + 1; break; default: printf("RRIP with incorrect flags?"); @@ -246,6 +248,8 @@ cd9660_rrip_altname(ISO_RRIP_ALTNAME *p, ISO_RRIP_ANALYZE *ana) /* Inserting component */ wlen = isonum_711(p->h.length) - 5; inbuf = (char *)p + 5; + if (wlen < 0) + wlen = ana->maxlen + 1; break; default:home | help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?69cd5291.1c22a.1a680901>