From 139c528ab8016711b6b59a4460afd0d6b236beb5 Mon Sep 17 00:00:00 2001

From: Tim Kientzle <kientzle@acm.org>

Date: Sat, 11 Apr 2015 22:44:12 -0700

Subject: [PATCH] This is a combination of 2 commits.

==  The first commit's message is: ==

Issue #522: Dir loop in malformed ISO causes segfault

Github Issue #522 revealed that we could blow the stack

when recursing to assemble ISO paths.  I saw this happen

at 130,000 dir levels.  This patch addresses this by limiting

the directory recursion to 1,000 elements.

TODO:  It would be even better to track and detect the dir loop

directly.

== This is the 2nd commit message: ==

Github Issue #522: Detect cycles in the ISO directory tree

---

 libarchive/archive_read_support_format_iso9660.c | 43 +++++++++++++++++++-----

 1 file changed, 34 insertions(+), 9 deletions(-)

diff --git a/libarchive/archive_read_support_format_iso9660.c b/libarchive/archive_read_support_format_iso9660.c

index 47268a2..6934cee 100644

--- a/libarchive/archive_read_support_format_iso9660.c

+++ b/libarchive/archive_read_support_format_iso9660.c

@@ -387,7 +387,7 @@ static int	archive_read_format_iso9660_read_data(struct archive_read *,

 static int	archive_read_format_iso9660_read_data_skip(struct archive_read *);

 static int	archive_read_format_iso9660_read_header(struct archive_read *,

 		    struct archive_entry *);

-static const char *build_pathname(struct archive_string *, struct file_info *);

+static const char *build_pathname(struct archive_string *, struct file_info *, int);

 static int	build_pathname_utf16be(unsigned char *, size_t, size_t *,

 		    struct file_info *);

 #if DEBUG

@@ -1225,6 +1225,7 @@ archive_read_format_iso9660_read_header(struct archive_read *a,

 			archive_set_error(&a->archive,

 			    ARCHIVE_ERRNO_FILE_FORMAT,

 			    "Pathname is too long");

+			return (ARCHIVE_FATAL);

 		}

 		r = archive_entry_copy_pathname_l(entry,

@@ -1247,9 +1248,16 @@ archive_read_format_iso9660_read_header(struct archive_read *a,

 			rd_r = ARCHIVE_WARN;

 		}

 	} else {

-		archive_string_empty(&iso9660->pathname);

-		archive_entry_set_pathname(entry,

-		    build_pathname(&iso9660->pathname, file));

+		const char *path = build_pathname(&iso9660->pathname, file, 0);

+		if (path == NULL) {

+			archive_set_error(&a->archive,

+			    ARCHIVE_ERRNO_FILE_FORMAT,

+			    "Pathname is too long");

+			return (ARCHIVE_FATAL);

+		} else {

+			archive_string_empty(&iso9660->pathname);

+			archive_entry_set_pathname(entry, path);

+		}

 	}

 	iso9660->entry_bytes_remaining = file->size;

@@ -1744,12 +1752,12 @@ parse_file_info(struct archive_read *a, struct file_info *parent,

     const unsigned char *isodirrec)

 {

 	struct iso9660 *iso9660;

-	struct file_info *file;

+	struct file_info *file, *filep;

 	size_t name_len;

 	const unsigned char *rr_start, *rr_end;

 	const unsigned char *p;

 	size_t dr_len;

-	uint64_t fsize;

+	uint64_t fsize, offset;

 	int32_t location;

 	int flags;

@@ -1793,6 +1801,16 @@ parse_file_info(struct archive_read *a, struct file_info *parent,

 		return (NULL);

 	}

+	/* Sanity check that this entry does not create a cycle. */

+	offset = iso9660->logical_block_size * (uint64_t)location;

+	for (filep = parent; filep != NULL; filep = filep->parent) {

+		if (filep->offset == offset) {

+			archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,

+			    "Directory structure contains loop");

+			return (NULL);

+		}

+	}

+

 	/* Create a new file entry and copy data from the ISO dir record. */

 	file = (struct file_info *)calloc(1, sizeof(*file));

 	if (file == NULL) {

@@ -1801,7 +1819,7 @@ parse_file_info(struct archive_read *a, struct file_info *parent,

 		return (NULL);

 	}

 	file->parent = parent;

-	file->offset = iso9660->logical_block_size * (uint64_t)location;

+	file->offset = offset;

 	file->size = fsize;

 	file->mtime = isodate7(isodirrec + DR_date_offset);

 	file->ctime = file->atime = file->mtime;

@@ -3169,10 +3187,17 @@ time_from_tm(struct tm *t)

 }

 static const char *

-build_pathname(struct archive_string *as, struct file_info *file)

+build_pathname(struct archive_string *as, struct file_info *file, int depth)

 {

+	// Plain ISO9660 only allows 8 dir levels; if we get

+	// to 1000, then something is very, very wrong.

+	if (depth > 1000) {

+		return NULL;

+	}

 	if (file->parent != NULL && archive_strlen(&file->parent->name) > 0) {

-		build_pathname(as, file->parent);

+		if (build_pathname(as, file->parent, depth + 1) == NULL) {

+			return NULL;

+		}

 		archive_strcat(as, "/");

 	}

 	if (archive_strlen(&file->name) == 0)

-- 

2.7.4