d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

etdump: exit on error if section header or entry offset is OOB

Browse Source 
PR:		263663
Reported by:	Robert Morris <rtm@lcs.mit.edu>
Reviewed by:	markj
MFC after:	1 week
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D35868
This commit is contained in:
Ed Maste 2022-05-03 16:13:37 -04:00
parent bb1f64b200
commit ddf77ec392
1 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
usr.bin/etdump/etdump.c
View File

@ -116,8 +116,8 @@ boot_catalog_valid(char *entry)
}
static int
dump_section(char *buffer, size_t offset, FILE *outfile, const char *filename,
struct outputter *outputter)
dump_section(char *buffer, size_t bufsize, size_t offset, FILE *outfile,
const char *filename, struct outputter *outputter)
{
boot_catalog_section_header *sh;
u_char platform_id;
@ -125,6 +125,8 @@ dump_section(char *buffer, size_t offset, FILE *outfile, const char *filename,
size_t entry_offset;
boot_catalog_section_entry *entry;
if (offset + sizeof(boot_catalog_section_header) > bufsize)
errx(1, "%s: section header out of bounds", filename);
sh = (boot_catalog_section_header *)&buffer[offset];
if (outputter->output_section != NULL) {
outputter->output_section(outfile, filename, sh);
@ -135,6 +137,10 @@ dump_section(char *buffer, size_t offset, FILE *outfile, const char *filename,
if (outputter->output_entry != NULL) {
for (i = 1; i <= (int)sh->num_section_entries[0]; i++) {
entry_offset = offset + i * ET_BOOT_ENTRY_SIZE;
if (entry_offset + sizeof(boot_catalog_section_entry) >
bufsize)
errx(1, "%s: section entry out of bounds",
filename);
entry =
(boot_catalog_section_entry *)&buffer[entry_offset];
outputter->output_entry(outfile, filename, entry,
@ -195,8 +201,8 @@ dump_eltorito(FILE *iso, const char *filename, FILE *outfile,
(uint8_t)entry[0] != ET_SECTION_HEADER_LAST)
break;
entry_count = dump_section(buffer, offset, outfile, filename,
outputter);
entry_count = dump_section(buffer, sizeof(buffer), offset,
outfile, filename, outputter);
offset += entry_count * ET_BOOT_ENTRY_SIZE;
}