tablet/grub
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fs/ntfs: Fix an OOB read when parsing directory entries from resident and non-resident index attributes

Browse Source 
This fix introduces checks to ensure that index entries are never read
beyond the corresponding directory index.

The lack of this check is a minor issue, likely not exploitable in any way.

Reported-by: Maxim Suhanov <dfirblog@gmail.com>
Signed-off-by: Maxim Suhanov <dfirblog@gmail.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This commit is contained in:
Maxim Suhanov 2023-08-28 16:33:17 +03:00 committed by Daniel Kiper
parent 0ed2458cc4
commit 7e5f031a6a
1 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
grub-core/fs/ntfs.c
View File

@ -599,7 +599,7 @@ get_utf8 (grub_uint8_t *in, grub_size_t len)
}
static int
list_file (struct grub_ntfs_file *diro, grub_uint8_t *pos,
list_file (struct grub_ntfs_file *diro, grub_uint8_t *pos, grub_uint8_t *end_pos,
grub_fshelp_iterate_dir_hook_t hook, void *hook_data)
{
grub_uint8_t *np;
@ -610,6 +610,9 @@ list_file (struct grub_ntfs_file *diro, grub_uint8_t *pos,
grub_uint8_t namespace;
char *ustr;
if ((pos >= end_pos) || (end_pos - pos < 0x52))
break;
if (pos[0xC] & 2) /* end signature */
break;
@ -617,6 +620,9 @@ list_file (struct grub_ntfs_file *diro, grub_uint8_t *pos,
ns = *(np++);
namespace = *(np++);
if (2 * ns > end_pos - pos - 0x52)
break;
/*
* Ignore files in DOS namespace, as they will reappear as Win32
* names.
@ -806,7 +812,9 @@ grub_ntfs_iterate_dir (grub_fshelp_node_t dir,
}
cur_pos += 0x10; /* Skip index root */
ret = list_file (mft, cur_pos + u16at (cur_pos, 0), hook, hook_data);
ret = list_file (mft, cur_pos + u16at (cur_pos, 0),
at->mft->buf + (at->mft->data->mft_size << GRUB_NTFS_BLK_SHR),
hook, hook_data);
if (ret)
goto done;
@ -893,6 +901,7 @@ grub_ntfs_iterate_dir (grub_fshelp_node_t dir,
(const grub_uint8_t *) "INDX")))
goto done;
ret = list_file (mft, &indx[0x18 + u16at (indx, 0x18)],
indx + (mft->data->idx_size << GRUB_NTFS_BLK_SHR),
hook, hook_data);
if (ret)
goto done;