vbatts/grub
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

fs/hfs: Add pointer sanity checks.

Browse source 
Found by: Coverity scan.
This commit is contained in:
Vladimir Serbinenko 2015-01-25 11:32:29 +01:00
parent 4387ca78f0
commit d0af2156c3
1 changed files with 13 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
grub-core/fs/hfs.c
View file

@ -692,6 +692,7 @@ grub_hfs_iterate_records (struct grub_hfs_data *data, int type, int idx,
int i; int i;
struct grub_hfs_extent *dat; struct grub_hfs_extent *dat;
int blk; int blk;
grub_uint16_t reccnt;
dat = (struct grub_hfs_extent *) (type == 0 dat = (struct grub_hfs_extent *) (type == 0
? (&data->sblock.catalog_recs) ? (&data->sblock.catalog_recs)
@ -710,8 +711,12 @@ grub_hfs_iterate_records (struct grub_hfs_data *data, int type, int idx,
return grub_errno; return grub_errno;
} }
reccnt = grub_be_to_cpu16 (node->node.reccnt);
if (reccnt > (nodesize >> 1))
reccnt = (nodesize >> 1);
/* Iterate over all records in this node. */ /* Iterate over all records in this node. */
for (i = 0; i < grub_be_to_cpu16 (node->node.reccnt); i++) for (i = 0; i < reccnt; i++)
{ {
int pos = (nodesize >> 1) - 1 - i; int pos = (nodesize >> 1) - 1 - i;
struct pointer struct pointer
@ -719,16 +724,19 @@ grub_hfs_iterate_records (struct grub_hfs_data *data, int type, int idx,
grub_uint8_t keylen; grub_uint8_t keylen;
grub_uint8_t key; grub_uint8_t key;
} GRUB_PACKED *pnt; } GRUB_PACKED *pnt;
pnt = (struct pointer *) (grub_be_to_cpu16 (node->offsets[pos]) grub_uint16_t off = grub_be_to_cpu16 (node->offsets[pos]);
+ node->rawnode); if (off > nodesize - sizeof(*pnt))
continue;
pnt = (struct pointer *) (off + node->rawnode);
if (nodesize < (grub_size_t) off + pnt->keylen + 1)
continue;
struct grub_hfs_record rec = struct grub_hfs_record rec =
{ {
&pnt->key, &pnt->key,
pnt->keylen, pnt->keylen,
&pnt->key + pnt->keylen +(pnt->keylen + 1) % 2, &pnt->key + pnt->keylen +(pnt->keylen + 1) % 2,
nodesize - grub_be_to_cpu16 (node->offsets[pos]) nodesize - off - pnt->keylen - 1
- pnt->keylen - 1
}; };
if (node_hook (&node->node, &rec, hook_arg)) if (node_hook (&node->node, &rec, hook_arg))