mirror/u-boot-2016
1
0
Fork 0
mirror of https://git.codelinaro.org/clo/qsdk/oss/boot/u-boot-2016.git synced 2025-12-10 07:44:53 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

CVE-2019-13103: disk: stop infinite recursion in DOS Partitions

Browse source 
part_get_info_extended and print_partition_extended can recurse infinitely
while parsing a self-referential filesystem or one with a silly number of
extended partitions. This patch adds a limit to the number of recursive
partitions.

Change-Id: Ibf1449684580a313869ce9961077c46a12a42d8c
Signed-off-by: Paul Emge <paulemge@forallsecure.com>
Signed-off-by: Karthick Shanmugham <kartshan@codeaurora.org>
This commit is contained in:
Paul Emge 2020-01-14 19:53:11 +05:30 • committed by Karthick Shanmugham
parent d180270132
commit 043f757bb9
1 changed files with 15 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
disk/part_dos.c
View file

@ -24,6 +24,10 @@
#define DOS_PART_DEFAULT_SECTOR 512
/* should this be configurable? It looks like it's not very common at all
* to use large numbers of partitions */
#define MAX_EXT_PARTS 256
/* Convert char[4] in little endian format to the host format integer
*/
static inline int le32_to_int(unsigned char *le32)
@ -109,6 +113,11 @@ static void print_partition_extended(block_dev_desc_t *dev_desc,
dos_partition_t *pt;
int i;
/* set a maximum recursion level */
if (part_num > MAX_EXT_PARTS) {
printf("** Nested DOS partitions detected, stopping **\n");
return;
}
if (dev_desc->block_read(dev_desc->dev, ext_part_sector, 1, (ulong *) buffer) != 1) {
printf ("** Can't read partition table on %d:%d **\n",
dev_desc->dev, ext_part_sector);
@ -173,6 +182,12 @@ static int get_partition_info_extended (block_dev_desc_t *dev_desc, int ext_part
int i;
int dos_type;
/* set a maximum recursion level */
if (part_num > MAX_EXT_PARTS) {
printf("** Nested DOS partitions detected, stopping **\n");
return -1;
}
if (dev_desc->block_read (dev_desc->dev, ext_part_sector, 1, (ulong *) buffer) != 1) {
printf ("** Can't read partition table on %d:%d **\n",
dev_desc->dev, ext_part_sector);