File 0019-CVE-2019-13103-disk-stop-infinite-r.patch of Package u-boot-clearfog

Overview Repositories Revisions Requests Users Attributes Meta

File 0019-CVE-2019-13103-disk-stop-infinite-r.patch of Package u-boot-clearfog (Revision cf23daf079ea62d8704d36ef6b850594)

Currently displaying revision cf23daf079ea62d8704d36ef6b850594 , Show latest

From 17c7cd77796ef2b3ea0f8ae51f4306ccba68a346 Mon Sep 17 00:00:00 2001
From: Paul Emge <paulemge@forallsecure.com>
Date: Mon, 8 Jul 2019 16:37:03 -0700
Subject: [PATCH] CVE-2019-13103: disk: stop infinite recursion in DOS
 Partitions

part_get_info_extended and print_partition_extended can recurse infinitely
while parsing a self-referential filesystem or one with a silly number of
extended partitions. This patch adds a limit to the number of recursive
partitions.

Signed-off-by: Paul Emge <paulemge@forallsecure.com>
(cherry picked from commit 232e2f4fd9a24bf08215ddc8c53ccadffc841fb5)
Signed-off-by: Matthias Brugger <mbrugger@suse.com>
---
 disk/part_dos.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/disk/part_dos.c b/disk/part_dos.c
index 84e672b47b..4ca7d129a3 100644
--- a/disk/part_dos.c
+++ b/disk/part_dos.c
@@ -24,6 +24,10 @@
 
 #define DOS_PART_DEFAULT_SECTOR 512
 
+/* should this be configurable? It looks like it's not very common at all
+ * to use large numbers of partitions */
+#define MAX_EXT_PARTS 256
+
 /* Convert char[4] in little endian format to the host format integer
  */
 static inline unsigned int le32_to_int(unsigned char *le32)
@@ -127,6 +131,13 @@ static void print_partition_extended(struct blk_desc *dev_desc,
 	dos_partition_t *pt;
 	int i;
 
+	/* set a maximum recursion level */
+	if (part_num > MAX_EXT_PARTS)
+	{
+		printf("** Nested DOS partitions detected, stopping **\n");
+		return;
+    }
+
 	if (blk_dread(dev_desc, ext_part_sector, 1, (ulong *)buffer) != 1) {
 		printf ("** Can't read partition table on %d:" LBAFU " **\n",
 			dev_desc->devnum, ext_part_sector);
@@ -192,6 +203,13 @@ static int part_get_info_extended(struct blk_desc *dev_desc,
 	int i;
 	int dos_type;
 
+	/* set a maximum recursion level */
+	if (part_num > MAX_EXT_PARTS)
+	{
+		printf("** Nested DOS partitions detected, stopping **\n");
+		return -1;
+    }
+
 	if (blk_dread(dev_desc, ext_part_sector, 1, (ulong *)buffer) != 1) {
 		printf ("** Can't read partition table on %d:" LBAFU " **\n",
 			dev_desc->devnum, ext_part_sector);

Places

File 0019-CVE-2019-13103-disk-stop-infinite-r.patch of Package u-boot-clearfog (Revision cf23daf079ea62d8704d36ef6b850594)

Places