diff options
| author | phk <phk@FreeBSD.org> | 2002-12-18 19:57:27 +0000 |
|---|---|---|
| committer | phk <phk@FreeBSD.org> | 2002-12-18 19:57:27 +0000 |
| commit | 761d063e808061f78a2bd10e65cc88ff442124c6 (patch) | |
| tree | 73efd719fdb177063848159195753ffb42085e80 /sys/geom/bde/g_bde_lock.c | |
| parent | 4052863334f88b834ae48faa0160fd6fdd753299 (diff) | |
| download | FreeBSD-src-761d063e808061f78a2bd10e65cc88ff442124c6.zip FreeBSD-src-761d063e808061f78a2bd10e65cc88ff442124c6.tar.gz | |
Fix two blunders in the mapping functions which can lead to corrupt data,
for request sizes larger than the sectorsize or for multi-key setups.
See warning mailed to current@ for details of recovery.
Found by: Marcus Reid <marcus@blazingdot.com>
Diffstat (limited to 'sys/geom/bde/g_bde_lock.c')
| -rw-r--r-- | sys/geom/bde/g_bde_lock.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/sys/geom/bde/g_bde_lock.c b/sys/geom/bde/g_bde_lock.c index e584c4d..75aa40b 100644 --- a/sys/geom/bde/g_bde_lock.c +++ b/sys/geom/bde/g_bde_lock.c @@ -430,6 +430,12 @@ g_bde_decrypt_lockx(struct g_bde_softc *sc, u_char *meta, off_t mediasize, u_int if (off[1] == 0) return (ENOENT); + /* If we have an unsorted lock-sequence, refuse */ + if (gl->lsector[0] > gl->lsector[1] || + gl->lsector[1] > gl->lsector[2] || + gl->lsector[2] > gl->lsector[3]) + return (EINVAL); + /* Finally, find out which key was used by matching the byte offset */ for (i = 0; i < G_BDE_MAXKEYS; i++) if (nkey != NULL && off[0] == gl->lsector[i]) |
