diff options
| author | riastradh <riastradh@NetBSD.org> | 2023-03-01 16:21:14 +0000 |
|---|---|---|
| committer | riastradh <riastradh@NetBSD.org> | 2023-03-01 16:21:14 +0000 |
| commit | e4daf6e6865b71b5ae6a904fa48754b641f6b060 (patch) | |
| tree | e5d5747f93ac64d43e974997a38bc072449348ac /sys | |
| parent | 939cd4d3c26e12d08c2786c0dcc50ff7a40df3cc (diff) | |
fs/hfs: Avoid buffer overrun in hfslib_reada_node_offsets.
XXX pullup-8
XXX pullup-9
XXX pullup-10
Diffstat (limited to 'sys')
| -rw-r--r-- | sys/fs/hfs/libhfs.c | 11 | ||||
| -rw-r--r-- | sys/fs/hfs/libhfs.h | 4 |
2 files changed, 9 insertions, 6 deletions
diff --git a/sys/fs/hfs/libhfs.c b/sys/fs/hfs/libhfs.c index ed9c9250f5e..6a4c468402a 100644 --- a/sys/fs/hfs/libhfs.c +++ b/sys/fs/hfs/libhfs.c @@ -1,4 +1,4 @@ -/* $NetBSD: libhfs.c,v 1.15 2018/12/30 22:40:00 sevan Exp $ */ +/* $NetBSD: libhfs.c,v 1.16 2023/03/01 16:21:14 riastradh Exp $ */ /*- * Copyright (c) 2005, 2007 The NetBSD Foundation, Inc. @@ -47,7 +47,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: libhfs.c,v 1.15 2018/12/30 22:40:00 sevan Exp $"); +__KERNEL_RCSID(0, "$NetBSD: libhfs.c,v 1.16 2023/03/01 16:21:14 riastradh Exp $"); #include "libhfs.h" @@ -1477,7 +1477,7 @@ hfslib_reada_node(void* in_bytes, HFS_LIBERR("could not allocate node records"); last_bytes_read = hfslib_reada_node_offsets((uint8_t*)in_bytes + nodesize - - numrecords * sizeof(uint16_t), rec_offsets); + numrecords * sizeof(uint16_t), rec_offsets, numrecords); if (last_bytes_read == 0) HFS_LIBERR("could not read node record offsets"); @@ -1566,7 +1566,8 @@ exit: * in reverse order. Does not read the free space offset. */ size_t -hfslib_reada_node_offsets(void* in_bytes, uint16_t* out_offset_array) +hfslib_reada_node_offsets(void* in_bytes, uint16_t* out_offset_array, + uint16_t numrecords) { void* ptr; @@ -1583,6 +1584,8 @@ hfslib_reada_node_offsets(void* in_bytes, uint16_t* out_offset_array) */ out_offset_array--; do { + if (numrecords-- == 0) + return 0; out_offset_array++; *out_offset_array = be16tohp(&ptr); } while (*out_offset_array != (uint16_t)14); diff --git a/sys/fs/hfs/libhfs.h b/sys/fs/hfs/libhfs.h index 05657cd55ed..67c183390fe 100644 --- a/sys/fs/hfs/libhfs.h +++ b/sys/fs/hfs/libhfs.h @@ -1,4 +1,4 @@ -/* $NetBSD: libhfs.h,v 1.8 2019/01/05 10:25:11 maya Exp $ */ +/* $NetBSD: libhfs.h,v 1.9 2023/03/01 16:21:14 riastradh Exp $ */ /*- * Copyright (c) 2005, 2007 The NetBSD Foundation, Inc. @@ -585,7 +585,7 @@ size_t hfslib_read_master_directory_block(void*, hfs_hfs_master_directory_block_t*); size_t hfslib_reada_node(void*, hfs_node_descriptor_t*, void***, uint16_t**, hfs_btree_file_type, hfs_volume*, hfs_callback_args*); -size_t hfslib_reada_node_offsets(void*, uint16_t*); +size_t hfslib_reada_node_offsets(void*, uint16_t*, uint16_t); size_t hfslib_read_header_node(void**, uint16_t*, uint16_t, hfs_header_record_t*, void*, void*); size_t hfslib_read_catalog_keyed_record(void*, hfs_catalog_keyed_record_t*, |
