* [PATCH] libblkid: prevent OOB access while probing HFS+
@ 2017-03-15 21:12 Tobias Stoeckmann
2017-03-23 14:48 ` Karel Zak
2017-03-24 10:49 ` Karel Zak
0 siblings, 2 replies; 3+ messages in thread
From: Tobias Stoeckmann @ 2017-03-15 21:12 UTC (permalink / raw)
To: util-linux
It is possible to perform out of boundary read accesses due to
insufficient boundary checks in probe_hfsplus.
The first issue occurs if the leaf count in a B-node is too
small. The second happens while parsing a unicode description which
is longer than 255 UTF-8 characters. The length is stored in a 16 bit
integer, but the array in the struct is limited to 255 * 2, which is
in sync with Apple's Open Source HFS+ implementation (HFSUniStr255).
Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
---
You can trigger the issue with these two small proof of concepts,
which contain byte sequences which imitate a HFS+ (but are broken
beyond repair, as I was just fiddling around with bits until they
did what I wanted to happen ;) ).
echo H4sICJKhyVgCA2lzby1wb2MtMQDt1LkNgDAURMFviSt1B9SCHNCAJTo\
hpXPjEkiBmfhFG+xWai1d684uIlJrOccVMU7zEimAj9qPp+Xw45VWLwgAAAA\
AAMAr3DUKOtIAIAAA | base64 -d - | gunzip > f1
echo H4sICKelyVgCA2lzby1wb2MtMgDt2rsJgFAMBdA88Ne6gbOIhQsIbuL\
48QkOYKue09wUKcOtMi/btlRZHVVElMxxrDm0XT80AXzVuj/d/HMTTMWlAAA\
AAAAA8CYZmfdYrl+AGfi8Exgn/EMAJAAA | base64 -d - | gunzip > f2
You can trigger the issue with the tool blkid this way:
# losetup -f $file
# blkid -p -n hfsplus /dev/loop0
---
libblkid/src/superblocks/hfs.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/libblkid/src/superblocks/hfs.c b/libblkid/src/superblocks/hfs.c
index ee502cf61..ef746d4e2 100644
--- a/libblkid/src/superblocks/hfs.c
+++ b/libblkid/src/superblocks/hfs.c
@@ -244,7 +244,8 @@ static int probe_hfsplus(blkid_probe pr, const struct blkid_idmag *mag)
leaf_node_head = be32_to_cpu(bnode->leaf_head);
leaf_node_size = be16_to_cpu(bnode->node_size);
leaf_node_count = be32_to_cpu(bnode->leaf_count);
- if (leaf_node_count == 0)
+ if (leaf_node_size < sizeof(struct hfsplus_bnode_descriptor) +
+ sizeof(struct hfsplus_catalog_key) || leaf_node_count == 0)
return 0;
leaf_block = (leaf_node_head * leaf_node_size) / blocksize;
@@ -284,7 +285,8 @@ static int probe_hfsplus(blkid_probe pr, const struct blkid_idmag *mag)
key = (struct hfsplus_catalog_key *)
&buf[sizeof(struct hfsplus_bnode_descriptor)];
- if (be32_to_cpu(key->parent_id) != HFSPLUS_POR_CNID)
+ if (be32_to_cpu(key->parent_id) != HFSPLUS_POR_CNID ||
+ be16_to_cpu(key->unicode_len > 255))
return 0;
blkid_probe_set_utf8label(pr, key->unicode,
--
2.12.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] libblkid: prevent OOB access while probing HFS+
2017-03-15 21:12 [PATCH] libblkid: prevent OOB access while probing HFS+ Tobias Stoeckmann
@ 2017-03-23 14:48 ` Karel Zak
2017-03-24 10:49 ` Karel Zak
1 sibling, 0 replies; 3+ messages in thread
From: Karel Zak @ 2017-03-23 14:48 UTC (permalink / raw)
To: Tobias Stoeckmann; +Cc: util-linux
On Wed, Mar 15, 2017 at 10:12:00PM +0100, Tobias Stoeckmann wrote:
> libblkid/src/superblocks/hfs.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
Applied, thanks.
Karel
--
Karel Zak <kzak@redhat.com>
http://karelzak.blogspot.com
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] libblkid: prevent OOB access while probing HFS+
2017-03-15 21:12 [PATCH] libblkid: prevent OOB access while probing HFS+ Tobias Stoeckmann
2017-03-23 14:48 ` Karel Zak
@ 2017-03-24 10:49 ` Karel Zak
1 sibling, 0 replies; 3+ messages in thread
From: Karel Zak @ 2017-03-24 10:49 UTC (permalink / raw)
To: Tobias Stoeckmann; +Cc: util-linux
On Wed, Mar 15, 2017 at 10:12:00PM +0100, Tobias Stoeckmann wrote:
> - if (be32_to_cpu(key->parent_id) != HFSPLUS_POR_CNID)
> + if (be32_to_cpu(key->parent_id) != HFSPLUS_POR_CNID ||
> + be16_to_cpu(key->unicode_len > 255))
Typo. Fixed. I guess it should be
be16_to_cpu(key->unicode_len) > 255
Note than we have regression tests for almost all filesystems. So you
$ cd tests
$ ./run.sh blkid
to see result.
Karel
--
Karel Zak <kzak@redhat.com>
http://karelzak.blogspot.com
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2017-03-24 10:49 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-03-15 21:12 [PATCH] libblkid: prevent OOB access while probing HFS+ Tobias Stoeckmann
2017-03-23 14:48 ` Karel Zak
2017-03-24 10:49 ` Karel Zak
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.