linux-kernel - Re: [Patch] Fix another bug in hfsplus when reading a corrupted image

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20080903171437.GA23969@alice>
Date:	Wed, 3 Sep 2008 19:14:38 +0200
From:	Eric Sesterhenn <snakebyte@....de>
To:	Roman Zippel <zippel@...ux-m68k.org>
Cc:	linux-kernel@...r.kernel.org, akpm@...ux-foundation.org
Subject: Re: [Patch] Fix another bug in hfsplus when reading a corrupted
	image

* Roman Zippel (zippel@...ux-m68k.org) wrote:
> Hi,
> 
> On Tue, 26 Aug 2008, Eric Sesterhenn wrote:
> 
> > Problem is that there is no ext_tree, causing the NULL-pointer
> > dereference in hfsplus_init(). This fixes the issue by checking the ext_tree in
> > hfsplus_get_block() and aborting early enoug.
> 
> The problem is worse, a corrupted extent for the extent file itself may 
> try to get an impossible extent, causing a deadlock if I see it correctly.
> A better fix would be to check the inode number after the first_blocks 
> checks and fail if it's the extent file, as according to the spec the 
> extent file should have no extent for itself.

I guess you had something in mind like this, which also fixes the issue
for me.

Signed-off-by: Eric Sesterhenn <snakebyte@....de>


--- linux/fs/hfsplus/extents.orig	2008-08-26 14:51:08.000000000 +0200
+++ linux/fs/hfsplus/extents.c	2008-09-03 17:58:35.000000000 +0200
@@ -199,6 +199,9 @@ int hfsplus_get_block(struct inode *inod
 		goto done;
 	}
 
+	if (inode->i_ino == HFSPLUS_EXT_CNID)
+		return -EIO;
+
 	mutex_lock(&HFSPLUS_I(inode).extents_lock);
 	res = hfsplus_ext_read_extent(inode, ablock);
 	if (!res) {
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/