Lncvrt/grub
1
0 Fork 0
mirror of https://git.savannah.gnu.org/git/grub.git synced 2026-10-23 15:49:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

fs/hfsplus: Prevent out of bound access in catalog file

Browse Source 
A corrupted hfsplus can have a catalog key that is out of range. This
can lead to out of bound access when advancing the pointer to access
catalog file info. The valid range of a catalog key is specified in
HFS Plus Technical Note TN1150 [1].

[1] https://developer.apple.com/library/archive/technotes/tn/tn1150.html

Signed-off-by: Lidong Chen <lidong.chen@oracle.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This commit is contained in:
Lidong Chen authored and Daniel Kiper committed 2023-05-17 18:19:02 +02:00
1 parent 3f6b129bdc
commit eb8b0aabb8
1 file changed
+10
Download Patch File Download Diff File Expand all files Collapse all files
grub-core/fs/hfsplus.c
+10
View File
@@ -87,6 +87,9 @@ struct grub_hfsplus_catfile
#define HFSPLUS_BTNODE_MINSZ (1 << 9) #define HFSPLUS_BTNODE_MINSZ (1 << 9)
#define HFSPLUS_BTNODE_MAXSZ (1 << 15) #define HFSPLUS_BTNODE_MAXSZ (1 << 15)
#define HFSPLUS_CATKEY_MIN_LEN 6
#define HFSPLUS_CATKEY_MAX_LEN 516
/* Some pre-defined file IDs. */ /* Some pre-defined file IDs. */
enum enum
{ {
@@ -702,6 +705,13 @@ list_nodes (void *record, void *hook_arg)
catkey = (struct grub_hfsplus_catkey *) record; catkey = (struct grub_hfsplus_catkey *) record;
if (grub_be_to_cpu16 (catkey->keylen) < HFSPLUS_CATKEY_MIN_LEN ||
grub_be_to_cpu16 (catkey->keylen) > HFSPLUS_CATKEY_MAX_LEN)
{
grub_error (GRUB_ERR_BAD_FS, "catalog key length is out of range");
return 1;
}
fileinfo = fileinfo =
(struct grub_hfsplus_catfile *) ((char *) record (struct grub_hfsplus_catfile *) ((char *) record
+ grub_be_to_cpu16 (catkey->keylen) + grub_be_to_cpu16 (catkey->keylen)