i2p/haiku-beta6
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

bfs: Made updating the boot block more secure.

Browse Source 
* It now also checks the length/offset indepdently from each other,
  so that they cannot benefit from integer overflow.
* This fixes bug #12943.
This commit is contained in:
Axel Dörfler
2017-01-10 09:07:21 +01:00
parent d5b6133b93
commit 44c76b26e8
1 changed files with 9 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/add-ons/kernel/file_systems/bfs/kernel_interface.cpp
+9 -4
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2001-2016, Axel Dörfler, [email protected].
* Copyright 2001-2017, Axel Dörfler, [email protected].
* This file may be used under the terms of the MIT License.
*/
@@ -714,12 +714,17 @@ bfs_ioctl(fs_volume* _volume, fs_vnode* _node, void* _cookie, uint32 cmd,
return B_BAD_VALUE;
if (user_memcpy(&update, buffer, sizeof(update_boot_block)) != B_OK)
return B_BAD_ADDRESS;
if (update.offset < offsetof(disk_super_block, pad_to_block)
|| update.length + update.offset > 512)
uint32 minOffset = offsetof(disk_super_block, pad_to_block);
if (update.offset < minOffset
|| update.offset >= 512 || update.length > 512 - minOffset
|| update.length + update.offset > 512) {
return B_BAD_VALUE;
}
if (user_memcpy((uint8*)&volume->SuperBlock() + update.offset,
update.data, update.length) != B_OK)
update.data, update.length) != B_OK) {
return B_BAD_ADDRESS;
}
return volume->WriteSuperBlock();
}