public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
* [SECURITY] CAN-2004-0109 isofs fix.
@ 2004-04-14 17:11 Dave Jones
  2004-04-14 20:30 ` [SECURITY] CAN-2004-0075 (was: Re: [SECURITY] CAN-2004-0109 isofs fix.) Marc-Christian Petersen
  0 siblings, 1 reply; 9+ messages in thread
From: Dave Jones @ 2004-04-14 17:11 UTC (permalink / raw)
  To: Linus Torvalds, Andrew Morton; +Cc: Linux Kernel, petrides

Merged in 2.4, and various vendor kernels today..

  iDefense reported a buffer overflow flaw in the ISO9660 filesystem code.
  An attacker could create a malicious filesystem in such a way that they
  could gain root privileges if that filesystem is mounted. The Common
  Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
  CAN-2004-0109 to this issue.

Ernie Petrides came up with the following patch which I fixed up a slight
reject in to apply to 2.6. Otherwise, unchanged from the 2.4 patch.

diff against bk-HEAD from a few minutes ago.

		Dave

--- linux/fs/isofs/rock.c.orig
+++ linux/fs/isofs/rock.c
@@ -14,6 +14,7 @@
 #include <linux/slab.h>
 #include <linux/pagemap.h>
 #include <linux/smp_lock.h>
 #include <linux/buffer_head.h>
+#include <asm/page.h>
 
 #include "rock.h"
@@ -419,7 +420,7 @@ int parse_rock_ridge_inode_internal(stru
   return 0;
 }
 
-static char *get_symlink_chunk(char *rpnt, struct rock_ridge *rr)
+static char *get_symlink_chunk(char *rpnt, struct rock_ridge *rr, char *plimit)
 {
 	int slen;
 	int rootflag;
@@ -431,16 +432,25 @@ static char *get_symlink_chunk(char *rpn
 		rootflag = 0;
 		switch (slp->flags & ~1) {
 		case 0:
+			if (slp->len > plimit - rpnt)
+				return NULL;
 			memcpy(rpnt, slp->text, slp->len);
 			rpnt+=slp->len;
 			break;
+		case 2:
+			if (rpnt >= plimit)
+				return NULL;
+			*rpnt++='.';
+			break;
 		case 4:
+			if (2 > plimit - rpnt)
+				return NULL;
 			*rpnt++='.';
-			/* fallthru */
-		case 2:
 			*rpnt++='.';
 			break;
 		case 8:
+			if (rpnt >= plimit)
+				return NULL;
 			rootflag = 1;
 			*rpnt++='/';
 			break;
@@ -457,17 +467,23 @@ static char *get_symlink_chunk(char *rpn
 			 * If there is another SL record, and this component
 			 * record isn't continued, then add a slash.
 			 */
-			if ((!rootflag) && (rr->u.SL.flags & 1) && !(oldslp->flags & 1))
+			if ((!rootflag) && (rr->u.SL.flags & 1) &&
+			    !(oldslp->flags & 1)) {
+				if (rpnt >= plimit)
+					return NULL;
 				*rpnt++='/';
+			}
 			break;
 		}
 
 		/*
 		 * If this component record isn't continued, then append a '/'.
 		 */
-		if (!rootflag && !(oldslp->flags & 1))
+		if (!rootflag && !(oldslp->flags & 1)) {
+			if (rpnt >= plimit)
+				return NULL;
 			*rpnt++='/';
-
+		}
 	}
 	return rpnt;
 }
@@ -548,7 +564,10 @@ static int rock_ridge_symlink_readpage(s
 			CHECK_SP(goto out);
 			break;
 		case SIG('S', 'L'):
-			rpnt = get_symlink_chunk(rpnt, rr);
+			rpnt = get_symlink_chunk(rpnt, rr,
+						 link + (PAGE_SIZE - 1));
+			if (rpnt == NULL)
+				goto out;
 			break;
 		case SIG('C', 'E'):
 			/* This tells is if there is a continuation record */


^ permalink raw reply	[flat|nested] 9+ messages in thread
end of thread, other threads:[~2004-04-15 10:21 UTC | newest]

Thread overview: 9+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2004-04-14 17:11 [SECURITY] CAN-2004-0109 isofs fix Dave Jones
2004-04-14 20:30 ` [SECURITY] CAN-2004-0075 (was: Re: [SECURITY] CAN-2004-0109 isofs fix.) Marc-Christian Petersen
2004-04-14 20:47   ` Dave Jones
2004-04-14 21:34     ` Marc-Christian Petersen
2004-04-14 21:27   ` Greg KH
2004-04-14 21:34     ` Marc-Christian Petersen
2004-04-15 10:04     ` [SECURITY] CAN-2004-0075 Michal Schmidt
2004-04-14 23:35   ` [SECURITY] CAN-2004-0177 (was: Re: [SECURITY] CAN-2004-0075) Marc-Christian Petersen
2004-04-15 10:21     ` Stephen C. Tweedie

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox