| Brad Bishop | 00e122a | 2019-10-05 11:10:57 -0400 | [diff] [blame] | 1 | From 39a759494f734c4cdc3e2b919671bfb3134b41ae Mon Sep 17 00:00:00 2001 |
| 2 | From: Paul Emge <paulemge@forallsecure.com> |
| 3 | Date: Mon, 8 Jul 2019 16:37:03 -0700 |
| 4 | Subject: [PATCH 1/9] CVE-2019-13103: disk: stop infinite recursion in DOS |
| 5 | Partitions |
| 6 | |
| 7 | part_get_info_extended and print_partition_extended can recurse infinitely |
| 8 | while parsing a self-referential filesystem or one with a silly number of |
| 9 | extended partitions. This patch adds a limit to the number of recursive |
| 10 | partitions. |
| 11 | |
| 12 | Signed-off-by: Paul Emge <paulemge@forallsecure.com> |
| 13 | |
| 14 | Upstream-Status: Backport[http://git.denx.de/?p=u-boot.git;a=commit; |
| 15 | h=232e2f4fd9a24bf08215ddc8c53ccadffc841fb5] |
| 16 | |
| 17 | CVE: CVE-2019-13103 |
| 18 | |
| 19 | Signed-off-by: Meng Li <Meng.Li@windriver.com> |
| 20 | --- |
| 21 | disk/part_dos.c | 18 ++++++++++++++++++ |
| 22 | 1 file changed, 18 insertions(+) |
| 23 | |
| 24 | diff --git a/disk/part_dos.c b/disk/part_dos.c |
| 25 | index 936cee0d36..aae9d95906 100644 |
| 26 | --- a/disk/part_dos.c |
| 27 | +++ b/disk/part_dos.c |
| 28 | @@ -23,6 +23,10 @@ |
| 29 | |
| 30 | #define DOS_PART_DEFAULT_SECTOR 512 |
| 31 | |
| 32 | +/* should this be configurable? It looks like it's not very common at all |
| 33 | + * to use large numbers of partitions */ |
| 34 | +#define MAX_EXT_PARTS 256 |
| 35 | + |
| 36 | /* Convert char[4] in little endian format to the host format integer |
| 37 | */ |
| 38 | static inline unsigned int le32_to_int(unsigned char *le32) |
| 39 | @@ -126,6 +130,13 @@ static void print_partition_extended(struct blk_desc *dev_desc, |
| 40 | dos_partition_t *pt; |
| 41 | int i; |
| 42 | |
| 43 | + /* set a maximum recursion level */ |
| 44 | + if (part_num > MAX_EXT_PARTS) |
| 45 | + { |
| 46 | + printf("** Nested DOS partitions detected, stopping **\n"); |
| 47 | + return; |
| 48 | + } |
| 49 | + |
| 50 | if (blk_dread(dev_desc, ext_part_sector, 1, (ulong *)buffer) != 1) { |
| 51 | printf ("** Can't read partition table on %d:" LBAFU " **\n", |
| 52 | dev_desc->devnum, ext_part_sector); |
| 53 | @@ -191,6 +202,13 @@ static int part_get_info_extended(struct blk_desc *dev_desc, |
| 54 | int i; |
| 55 | int dos_type; |
| 56 | |
| 57 | + /* set a maximum recursion level */ |
| 58 | + if (part_num > MAX_EXT_PARTS) |
| 59 | + { |
| 60 | + printf("** Nested DOS partitions detected, stopping **\n"); |
| 61 | + return -1; |
| 62 | + } |
| 63 | + |
| 64 | if (blk_dread(dev_desc, ext_part_sector, 1, (ulong *)buffer) != 1) { |
| 65 | printf ("** Can't read partition table on %d:" LBAFU " **\n", |
| 66 | dev_desc->devnum, ext_part_sector); |
| 67 | -- |
| 68 | 2.17.1 |
| 69 | |