dcavalca / rpms / util-linux

Forked from rpms/util-linux 2 years ago
Clone

Blame SOURCES/0114-libblkid-Avoid-OOB-access-on-illegal-ZFS-superblocks.patch

64664a
From 7e1c9da4773237e368bdc0539ef91d55ef19806c Mon Sep 17 00:00:00 2001
64664a
From: Tobias Stoeckmann <tobias@stoeckmann.org>
64664a
Date: Sun, 28 Aug 2016 21:15:59 +0200
64664a
Subject: [PATCH 114/116] libblkid: Avoid OOB access on illegal ZFS superblocks
64664a
64664a
64 bit systems can trigger an out of boundary access while performing
64664a
a ZFS superblock probe.
64664a
64664a
This happens due to a possible integer overflow while calculating
64664a
the remaining available bytes. The variable is of type "int" and the
64664a
string length is allowed to be larger than INT_MAX, which means that
64664a
avail calculation can overflow, circumventing the "avail < 0" check and
64664a
therefore accessing memory outside the "buff" array later on.
64664a
64664a
[kzak@redhat.com (rhel7): - remove unused swab_magic]
64664a
64664a
Upstream: https://github.com/karelzak/util-linux/commit/8fa57ab0b5696031da800e243def32bc5265ff6d
64664a
Addresses: https://bugzilla.redhat.com/show_bug.cgi?id=1392661
64664a
Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
64664a
Signed-off-by: Karel Zak <kzak@redhat.com>
64664a
---
64664a
 libblkid/src/superblocks/zfs.c | 3 +--
64664a
 1 file changed, 1 insertion(+), 2 deletions(-)
64664a
64664a
diff --git a/libblkid/src/superblocks/zfs.c b/libblkid/src/superblocks/zfs.c
64664a
index ff12fa6..2c7b4b7 100644
64664a
--- a/libblkid/src/superblocks/zfs.c
64664a
+++ b/libblkid/src/superblocks/zfs.c
64664a
@@ -115,7 +115,7 @@ static void zfs_extract_guid_name(blkid_probe pr, loff_t offset)
64664a
 
64664a
 			nvs->nvs_type = be32_to_cpu(nvs->nvs_type);
64664a
 			nvs->nvs_strlen = be32_to_cpu(nvs->nvs_strlen);
64664a
-			if (nvs->nvs_strlen > UINT_MAX - sizeof(*nvs))
64664a
+			if (nvs->nvs_strlen > INT_MAX - sizeof(*nvs))
64664a
 				break;
64664a
 			avail -= nvs->nvs_strlen + sizeof(*nvs);
64664a
 			nvdebug("nvstring: type %u string %*s\n", nvs->nvs_type,
64664a
@@ -201,7 +201,6 @@ static int find_uberblocks(const void *label, loff_t *ub_offset, int *swap_endia
64664a
  * #4 (@ 132kB) is the first one written on a new filesystem. */
64664a
 static int probe_zfs(blkid_probe pr, const struct blkid_idmag *mag)
64664a
 {
64664a
-	uint64_t swab_magic = swab64(UBERBLOCK_MAGIC);
64664a
 	int swab_endian = 0;
64664a
 	struct zfs_uberblock *ub;
64664a
 	loff_t offset, ub_offset = 0;
64664a
-- 
64664a
2.9.3
64664a