|
 |
8af939 |
diff -rupN cryptsetup-2.0.3.old/lib/luks2/luks2_json_metadata.c cryptsetup-2.0.3/lib/luks2/luks2_json_metadata.c
|
|
|
8af939 |
--- cryptsetup-2.0.3.old/lib/luks2/luks2_json_metadata.c 2019-03-27 16:14:49.790420791 +0100
|
|
|
8af939 |
+++ cryptsetup-2.0.3/lib/luks2/luks2_json_metadata.c 2019-03-27 16:23:50.499187212 +0100
|
|
|
8af939 |
@@ -363,12 +363,13 @@ static json_bool segment_has_digest(cons
|
|
|
8af939 |
return FALSE;
|
|
|
8af939 |
}
|
|
|
8af939 |
|
|
|
8af939 |
-static json_bool validate_intervals(int length, const struct interval *ix, uint64_t *data_offset)
|
|
|
8af939 |
+static json_bool validate_intervals(int length, const struct interval *ix,
|
|
|
8af939 |
+ uint64_t metadata_size, uint64_t keyslots_area_end)
|
|
|
8af939 |
{
|
|
|
8af939 |
int j, i = 0;
|
|
|
8af939 |
|
|
|
8af939 |
while (i < length) {
|
|
|
8af939 |
- if (ix[i].offset < 2 * LUKS2_HDR_16K_LEN) {
|
|
|
8af939 |
+ if (ix[i].offset < 2 * metadata_size) {
|
|
|
8af939 |
log_dbg("Illegal area offset: %" PRIu64 ".", ix[i].offset);
|
|
|
8af939 |
return FALSE;
|
|
|
8af939 |
}
|
|
|
8af939 |
@@ -378,10 +379,9 @@ static json_bool validate_intervals(int
|
|
|
8af939 |
return FALSE;
|
|
|
8af939 |
}
|
|
|
8af939 |
|
|
|
8af939 |
- /* first segment at offset 0 means we have detached header. Do not check then. */
|
|
|
8af939 |
- if (*data_offset && (ix[i].offset + ix[i].length) > *data_offset) {
|
|
|
8af939 |
- log_dbg("Area [%" PRIu64 ", %" PRIu64 "] intersects with segment starting at offset: %" PRIu64,
|
|
|
8af939 |
- ix[i].offset, ix[i].offset + ix[i].length, *data_offset);
|
|
|
8af939 |
+ if ((ix[i].offset + ix[i].length) > keyslots_area_end) {
|
|
|
8af939 |
+ log_dbg("Area [%" PRIu64 ", %" PRIu64 "] overflows binary keyslots area (ends at offset: %" PRIu64 ").",
|
|
|
8af939 |
+ ix[i].offset, ix[i].offset + ix[i].length, keyslots_area_end);
|
|
|
8af939 |
return FALSE;
|
|
|
8af939 |
}
|
|
|
8af939 |
|
|
|
8af939 |
@@ -596,12 +596,24 @@ static int hdr_validate_segments(json_ob
|
|
|
8af939 |
return 0;
|
|
|
8af939 |
}
|
|
|
8af939 |
|
|
|
8af939 |
+static uint64_t LUKS2_metadata_size(json_object *jobj)
|
|
|
8af939 |
+{
|
|
|
8af939 |
+ json_object *jobj1, *jobj2;
|
|
|
8af939 |
+ uint64_t json_size;
|
|
|
8af939 |
+
|
|
|
8af939 |
+ json_object_object_get_ex(jobj, "config", &jobj1);
|
|
|
8af939 |
+ json_object_object_get_ex(jobj1, "json_size", &jobj2);
|
|
|
8af939 |
+ json_str_to_uint64(jobj2, &json_size);
|
|
|
8af939 |
+
|
|
|
8af939 |
+ return json_size + LUKS2_HDR_BIN_LEN;
|
|
|
8af939 |
+}
|
|
|
8af939 |
+
|
|
|
8af939 |
static int hdr_validate_areas(json_object *hdr_jobj)
|
|
|
8af939 |
{
|
|
|
8af939 |
struct interval *intervals;
|
|
|
8af939 |
json_object *jobj_keyslots, *jobj_offset, *jobj_length, *jobj_segments, *jobj_area;
|
|
|
8af939 |
int length, ret, i = 0;
|
|
|
8af939 |
- uint64_t first_offset, keyslots_size, keyslots_area_sum = 0;
|
|
|
8af939 |
+ uint64_t keyslots_size, metadata_size, keyslots_area_sum = 0;
|
|
|
8af939 |
|
|
|
8af939 |
if (!json_object_object_get_ex(hdr_jobj, "keyslots", &jobj_keyslots))
|
|
|
8af939 |
return 1;
|
|
|
8af939 |
@@ -611,6 +623,7 @@ static int hdr_validate_areas(json_objec
|
|
|
8af939 |
|
|
|
8af939 |
/* config is already validated */
|
|
|
8af939 |
keyslots_size = LUKS2_keyslots_size(hdr_jobj);
|
|
|
8af939 |
+ metadata_size = LUKS2_metadata_size(hdr_jobj);
|
|
|
8af939 |
|
|
|
8af939 |
length = json_object_object_length(jobj_keyslots);
|
|
|
8af939 |
|
|
|
8af939 |
@@ -663,9 +676,7 @@ static int hdr_validate_areas(json_objec
|
|
|
8af939 |
return 1;
|
|
|
8af939 |
}
|
|
|
8af939 |
|
|
|
8af939 |
- first_offset = get_first_data_offset(jobj_segments, NULL);
|
|
|
8af939 |
-
|
|
|
8af939 |
- ret = validate_intervals(length, intervals, &first_offset) ? 0 : 1;
|
|
|
8af939 |
+ ret = validate_intervals(length, intervals, metadata_size, LUKS2_hdr_and_areas_size(hdr_jobj)) ? 0 : 1;
|
|
|
8af939 |
|
|
|
8af939 |
free(intervals);
|
|
|
8af939 |
|
|
|
8af939 |
@@ -918,14 +929,7 @@ uint64_t LUKS2_keyslots_size(json_object
|
|
|
8af939 |
|
|
|
8af939 |
uint64_t LUKS2_hdr_and_areas_size(json_object *jobj)
|
|
|
8af939 |
{
|
|
|
8af939 |
- json_object *jobj1, *jobj2;
|
|
|
8af939 |
- uint64_t json_size;
|
|
|
8af939 |
-
|
|
|
8af939 |
- json_object_object_get_ex(jobj, "config", &jobj1);
|
|
|
8af939 |
- json_object_object_get_ex(jobj1, "json_size", &jobj2);
|
|
|
8af939 |
- json_str_to_uint64(jobj2, &json_size);
|
|
|
8af939 |
-
|
|
|
8af939 |
- return 2 * (json_size + LUKS2_HDR_BIN_LEN) + LUKS2_keyslots_size(jobj);
|
|
|
8af939 |
+ return 2 * LUKS2_metadata_size(jobj) + LUKS2_keyslots_size(jobj);
|
|
|
8af939 |
}
|
|
|
8af939 |
|
|
|
8af939 |
int LUKS2_hdr_backup(struct crypt_device *cd, struct luks2_hdr *hdr,
|