| Brad Bishop | bba38f3 | 2018-08-23 16:11:46 +0800 | [diff] [blame] | 1 | From f9569c086ff29259c73790db9cbf39fe8fb9d862 Mon Sep 17 00:00:00 2001 |
| 2 | From: John Starks <jostarks@microsoft.com> |
| 3 | Date: Wed, 25 Jul 2018 12:16:34 -0700 |
| 4 | Subject: [PATCH] iso9660: validate directory record length |
| 5 | |
| 6 | CVE: CVE-2017-14501 |
| 7 | Upstream-Status: Backport [https://github.com/mmatuska/libarchive/commit/13e87dcd9c37b533127cceb9f3e1e5a38d95e784] |
| 8 | |
| 9 | Signed-off-by: Jagadeesh Krishnanjanappa <jkrishnanjanappa@mvista.com> |
| 10 | --- |
| 11 | libarchive/archive_read_support_format_iso9660.c | 17 +++++++++++------ |
| 12 | 1 file changed, 11 insertions(+), 6 deletions(-) |
| 13 | |
| 14 | diff --git a/libarchive/archive_read_support_format_iso9660.c b/libarchive/archive_read_support_format_iso9660.c |
| 15 | index f01d37bf..089bb723 100644 |
| 16 | --- a/libarchive/archive_read_support_format_iso9660.c |
| 17 | +++ b/libarchive/archive_read_support_format_iso9660.c |
| 18 | @@ -409,7 +409,8 @@ static int next_entry_seek(struct archive_read *, struct iso9660 *, |
| 19 | struct file_info **); |
| 20 | static struct file_info * |
| 21 | parse_file_info(struct archive_read *a, |
| 22 | - struct file_info *parent, const unsigned char *isodirrec); |
| 23 | + struct file_info *parent, const unsigned char *isodirrec, |
| 24 | + size_t reclen); |
| 25 | static int parse_rockridge(struct archive_read *a, |
| 26 | struct file_info *file, const unsigned char *start, |
| 27 | const unsigned char *end); |
| 28 | @@ -1022,7 +1023,7 @@ read_children(struct archive_read *a, struct file_info *parent) |
| 29 | if (*(p + DR_name_len_offset) == 1 |
| 30 | && *(p + DR_name_offset) == '\001') |
| 31 | continue; |
| 32 | - child = parse_file_info(a, parent, p); |
| 33 | + child = parse_file_info(a, parent, p, b - p); |
| 34 | if (child == NULL) { |
| 35 | __archive_read_consume(a, skip_size); |
| 36 | return (ARCHIVE_FATAL); |
| 37 | @@ -1112,7 +1113,7 @@ choose_volume(struct archive_read *a, struct iso9660 *iso9660) |
| 38 | */ |
| 39 | seenJoliet = iso9660->seenJoliet;/* Save flag. */ |
| 40 | iso9660->seenJoliet = 0; |
| 41 | - file = parse_file_info(a, NULL, block); |
| 42 | + file = parse_file_info(a, NULL, block, vd->size); |
| 43 | if (file == NULL) |
| 44 | return (ARCHIVE_FATAL); |
| 45 | iso9660->seenJoliet = seenJoliet; |
| 46 | @@ -1144,7 +1145,7 @@ choose_volume(struct archive_read *a, struct iso9660 *iso9660) |
| 47 | return (ARCHIVE_FATAL); |
| 48 | } |
| 49 | iso9660->seenJoliet = 0; |
| 50 | - file = parse_file_info(a, NULL, block); |
| 51 | + file = parse_file_info(a, NULL, block, vd->size); |
| 52 | if (file == NULL) |
| 53 | return (ARCHIVE_FATAL); |
| 54 | iso9660->seenJoliet = seenJoliet; |
| 55 | @@ -1749,7 +1750,7 @@ archive_read_format_iso9660_cleanup(struct archive_read *a) |
| 56 | */ |
| 57 | static struct file_info * |
| 58 | parse_file_info(struct archive_read *a, struct file_info *parent, |
| 59 | - const unsigned char *isodirrec) |
| 60 | + const unsigned char *isodirrec, size_t reclen) |
| 61 | { |
| 62 | struct iso9660 *iso9660; |
| 63 | struct file_info *file, *filep; |
| 64 | @@ -1763,7 +1764,11 @@ parse_file_info(struct archive_read *a, struct file_info *parent, |
| 65 | |
| 66 | iso9660 = (struct iso9660 *)(a->format->data); |
| 67 | |
| 68 | - dr_len = (size_t)isodirrec[DR_length_offset]; |
| 69 | + if (reclen == 0 || reclen < (dr_len = (size_t)isodirrec[DR_length_offset])) { |
| 70 | + archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC, |
| 71 | + "Invalid directory record length"); |
| 72 | + return (NULL); |
| 73 | + } |
| 74 | name_len = (size_t)isodirrec[DR_name_len_offset]; |
| 75 | location = archive_le32dec(isodirrec + DR_extent_offset); |
| 76 | fsize = toi(isodirrec + DR_size_offset, DR_size_size); |
| 77 | -- |
| 78 | 2.13.3 |
| 79 | |