diff options
| author | cem <cem@FreeBSD.org> | 2016-04-26 22:30:54 +0000 |
|---|---|---|
| committer | cem <cem@FreeBSD.org> | 2016-04-26 22:30:54 +0000 |
| commit | 87aa84524607d49d08b1ac14f832d7c468faf51e (patch) | |
| tree | de018e53d80a00b57b709559bf8db67415e7ed8b /sys/geom | |
| parent | cfbeb94fb2b947fabf788f145d3df7c5f9f928a0 (diff) | |
| download | FreeBSD-src-87aa84524607d49d08b1ac14f832d7c468faf51e.zip FreeBSD-src-87aa84524607d49d08b1ac14f832d7c468faf51e.tar.gz | |
g_part_bsd64: Check for valid on-disk npartitions value
This value is u32 on disk, but assigned to an int in memory. After we do the
implicit conversion via assignment, check that the result is at least one[1]
(non-negative[2]).
1. The subsequent for-loop iterates from gpt_entries minus one, down, until
reaching zero. A negative or zero initial index results in undefined signed
integer overflow.
2. It is also used to index into arrays later.
In practice, we expected non-malicious disks to contain small positive values.
Reported by: Coverity
CID: 1223202
Sponsored by: EMC / Isilon Storage Division
Diffstat (limited to 'sys/geom')
| -rw-r--r-- | sys/geom/part/g_part_bsd64.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/sys/geom/part/g_part_bsd64.c b/sys/geom/part/g_part_bsd64.c index 2b88fea..9ae28a81 100644 --- a/sys/geom/part/g_part_bsd64.c +++ b/sys/geom/part/g_part_bsd64.c @@ -509,7 +509,8 @@ g_part_bsd64_read(struct g_part_table *basetable, struct g_consumer *cp) dlp = (struct disklabel64 *)buf; basetable->gpt_entries = le32toh(dlp->d_npartitions); - if (basetable->gpt_entries > MAXPARTITIONS64) + if (basetable->gpt_entries > MAXPARTITIONS64 || + basetable->gpt_entries < 1) goto invalid_label; v32 = le32toh(dlp->d_crc); dlp->d_crc = 0; |
