From 50d1594c2e6142a3b51d2143c74027480df082e0 Mon Sep 17 00:00:00 2001 From: Karel Zak Date: Tue, 12 Jul 2016 13:34:54 +0200 Subject: [PATCH] libblkid: avoid non-empty recursion in EBR This is extension to the patch 7164a1c34d18831ac61c6744ad14ce916d389b3f. We also need to detect non-empty recursion in the EBR chain. It's possible to create standard valid logical partitions and in the last one points back to the EBR chain. In this case all offsets will be non-empty. Unfortunately, it's valid to create logical partitions that are not in the "disk order" (sorted by start offset). So link somewhere back is valid, but this link cannot points to already existing partition (otherwise we will see recursion). This patch forces libblkid to ignore duplicate logical partitions, the duplicate chain segment is interpreted as non-data segment, after 100 iterations with non-data segments it will break the loop -- no memory is allocated in this case by the loop. Addresses: https://bugzilla.redhat.com/show_bug.cgi?id=1349536 References: http://seclists.org/oss-sec/2016/q3/40 Signed-off-by: Karel Zak Upstream-status: Backport CVE: CVE-2016-5011 patch 2 Signed-off-by: Armin Kuster --- libblkid/src/partitions/dos.c | 7 +++++++ libblkid/src/partitions/partitions.c | 14 ++++++++++++++ libblkid/src/partitions/partitions.h | 2 ++ 3 files changed, 23 insertions(+) Index: util-linux-2.26.2/libblkid/src/partitions/dos.c =================================================================== --- util-linux-2.26.2.orig/libblkid/src/partitions/dos.c +++ util-linux-2.26.2/libblkid/src/partitions/dos.c @@ -105,6 +105,13 @@ static int parse_dos_extended(blkid_prob continue; } + /* Avoid recursive non-empty links, see ct_nodata counter */ + if (blkid_partlist_get_partition_by_start(ls, abs_start)) { + DBG(LOWPROBE, ul_debug("#%d: EBR duplicate data partition [abs start=%u] -- ignore", + i + 1, abs_start)); + continue; + } + par = blkid_partlist_add_partition(ls, tab, abs_start, size); if (!par) return -ENOMEM; Index: util-linux-2.26.2/libblkid/src/partitions/partitions.c =================================================================== --- util-linux-2.26.2.orig/libblkid/src/partitions/partitions.c +++ util-linux-2.26.2/libblkid/src/partitions/partitions.c @@ -940,6 +940,20 @@ blkid_partition blkid_partlist_get_parti return &ls->parts[n]; } +blkid_partition blkid_partlist_get_partition_by_start(blkid_partlist ls, uint64_t start) +{ + int i, nparts; + blkid_partition par; + + nparts = blkid_partlist_numof_partitions(ls); + for (i = 0; i < nparts; i++) { + par = blkid_partlist_get_partition(ls, i); + if ((uint64_t) blkid_partition_get_start(par) == start) + return par; + } + return NULL; +} + /** * blkid_partlist_get_partition_by_partno * @ls: partitions list Index: util-linux-2.26.2/libblkid/src/partitions/partitions.h =================================================================== --- util-linux-2.26.2.orig/libblkid/src/partitions/partitions.h +++ util-linux-2.26.2/libblkid/src/partitions/partitions.h @@ -21,6 +21,8 @@ extern int blkid_partlist_increment_part extern blkid_partition blkid_partlist_get_parent(blkid_partlist ls); +extern blkid_partition blkid_partlist_get_partition_by_start(blkid_partlist ls, uint64_t start); + extern int blkid_partitions_do_subprobe(blkid_probe pr, blkid_partition parent, const struct blkid_idinfo *id);