tablet/grub
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fs/iso9660: Incorrect check for entry boundary

Browse Source 
An SL entry consists of the entry info and the component area.
The entry info should take up 5 bytes instead of sizeof(*entry).
The area after the first 5 bytes is the component area. It is
incorrect to use the sizeof(*entry) to check the entry boundary.

Signed-off-by: Lidong Chen <lidong.chen@oracle.com>
Reviewed-by: Thomas Schmitt <scdbackup@gmx.net>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This commit is contained in:
Lidong Chen 2023-01-20 19:39:41 +00:00 committed by Daniel Kiper
parent c44b1428c4
commit 77f657dc9e
1 changed files with 15 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
grub-core/fs/iso9660.c
View File

@ -669,10 +669,23 @@ susp_iterate_dir (struct grub_iso9660_susp_entry *entry,
else if (grub_strncmp ("SL", (char *) entry->sig, 2) == 0)
{
unsigned int pos = 1;
unsigned int csize;
/* The symlink is not stored as a POSIX symlink, translate it. */
while (pos + sizeof (*entry) < entry->len)
/* The symlink is not stored as a POSIX symlink, translate it. */
while ((pos + GRUB_ISO9660_SUSP_HEADER_SZ + 1) < entry->len)
{
/*
* entry->len is GRUB_ISO9660_SUSP_HEADER_SZ + 1 (the FLAGS) +
* length of the "Component Area". The length of a component
* record is 2 (pos and pos + 1) plus the "Component Content",
* of which starts at pos + 2. entry->data[pos] is the
* "Component Flags"; entry->data[pos + 1] is the length
* of the component.
*/
csize = entry->data[pos + 1] + 2;
if (GRUB_ISO9660_SUSP_HEADER_SZ + 1 + csize > entry->len)
break;
/* The current position is the `Component Flag'. */
switch (entry->data[pos] & 30)
{