* Pekka Enberg (penberg@xxxxxxxxxxxxxx) wrote:Hi Eric,
On Sun, Aug 24, 2008 at 4:07 PM, Eric Sesterhenn <snakebyte@xxxxxx> wrote:when an hfsplus image gets corrupted it might happen that the catalogSo, where does this 127 come from? I can only find reference to a
namelength field gets b0rked. If we mount such an image
the memcpy() in hfsplus_cat_build_key_uni() writes more than the 255
that fit in the name field. Depending on the size of the overwritten
data, we either only get memory corruption or also trigger an oops like
this:
--- linux/fs/hfsplus/catalog.c.orig 2008-08-24 14:52:03.000000000 +0200
+++ linux/fs/hfsplus/catalog.c 2008-08-24 14:54:15.000000000 +0200
@@ -168,6 +168,11 @@ int hfsplus_find_cat(struct super_block
return -EIO;
}
+ if (be16_to_cpu(tmp.thread.nodeName.length) >= 127) {
+ printk(KERN_ERR "hfs: catalog name length corrupted\n");
+ return -EIO;
+ }
maximum length of 255 unicode characters (16 bits per character) in
the following technical note for HFS+ (see sections "HFS Plus Names"
and "Catalog Thread Records"):
http://developer.apple.com/technotes/tn/tn1150.html
Hmm?
Ah, i missed that the name array is __be16, i somehow assumed it was a
char array, and tried to account for the multiplication by 2 in hfsplus_cat_build_key_uni(). here is an updated fix.
Signed-off-by: Eric Sesterhenn <snakebyte@xxxxxx>
--- linux/fs/hfsplus/catalog.c.orig 2008-08-24 14:52:03.000000000 +0200
+++ linux/fs/hfsplus/catalog.c 2008-08-24 14:54:15.000000000 +0200
@@ -168,6 +168,11 @@ int hfsplus_find_cat(struct super_block return -EIO;
}
+ if (be16_to_cpu(tmp.thread.nodeName.length) > 255) {
+ printk(KERN_ERR "hfs: catalog name length corrupted\n");
+ return -EIO;
+ }
+
hfsplus_cat_build_key_uni(fd->search_key, be32_to_cpu(tmp.thread.parentID),
&tmp.thread.nodeName);
return hfs_brec_find(fd);