tablet/grub
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fs/iso9660: Add check to prevent infinite loop

Browse Source 
There is no check for the end of block when reading
directory extents. It resulted in read_node() always
read from the same offset in the while loop, thus
caused infinite loop. The fix added a check for the
end of the block and ensure the read is within directory
boundary.

Signed-off-by: Lidong Chen <lidong.chen@oracle.com>
Reviewed-by: Thomas Schmitt <scdbackup@gmx.net>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This commit is contained in:
Lidong Chen 2023-01-20 19:39:38 +00:00 committed by Daniel Kiper
parent b073ce8d88
commit 4e0bab34ec
1 changed files with 22 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
grub-core/fs/iso9660.c
View File

@ -801,6 +801,16 @@ grub_iso9660_iterate_dir (grub_fshelp_node_t dir,
while (dirent.flags & FLAG_MORE_EXTENTS)
{
offset += dirent.len;
/* offset should within the dir's len. */
if (offset > len)
{
if (ctx.filename_alloc)
grub_free (ctx.filename);
grub_free (node);
return 0;
}
if (read_node (dir, offset, sizeof (dirent), (char *) &dirent))
{
if (ctx.filename_alloc)
@ -808,6 +818,18 @@ grub_iso9660_iterate_dir (grub_fshelp_node_t dir,
grub_free (node);
return 0;
}
/*
* It is either the end of block or zero-padded sector,
* skip to the next block.
*/
if (!dirent.len)
{
offset = (offset / GRUB_ISO9660_BLKSZ + 1) * GRUB_ISO9660_BLKSZ;
dirent.flags |= FLAG_MORE_EXTENTS;
continue;
}
if (node->have_dirents >= node->alloc_dirents)
{
struct grub_fshelp_node *new_node;