git: c7194e88e423 - stable/14 - cd9660: Don't parse RRIP records whose length overflows the sector boundary

The branch stable/14 has been updated by jhb:

URL: https://cgit.FreeBSD.org/src/commit/?id=c7194e88e42387a8ebbf868f94c13c61df81ffc6

commit c7194e88e42387a8ebbf868f94c13c61df81ffc6
Author:     John Baldwin <jhb@FreeBSD.org>
AuthorDate: 2026-06-10 13:44:10 +0000
Commit:     John Baldwin <jhb@FreeBSD.org>
CommitDate: 2026-10-08 18:23:13 +0000

    cd9660: Don't parse RRIP records whose length overflows the sector boundary
    
    PR:             272896
    Reported by:    Robert Morris <rtm@lcs.mit.edu>
    Reviewed by:    des, emaste
    Differential Revision:  https://reviews.freebsd.org/D57135
    
    (cherry picked from commit 0492dbe9212ee0172e8003c487f256015478edd6)
---
 sys/fs/cd9660/cd9660_rrip.c | 26 ++++++++++++++++++--------
 1 file changed, 18 insertions(+), 8 deletions(-)

diff --git a/sys/fs/cd9660/cd9660_rrip.c b/sys/fs/cd9660/cd9660_rrip.c
index dde280815650..20f39656730c 100644
--- a/sys/fs/cd9660/cd9660_rrip.c
+++ b/sys/fs/cd9660/cd9660_rrip.c
@@ -467,6 +467,7 @@ cd9660_rrip_loop(struct iso_directory_record *isodir, ISO_RRIP_ANALYZE *ana,
 	RRIP_TABLE *ptable;
 	ISO_SUSP_HEADER *phead;
 	ISO_SUSP_HEADER *pend;
+	ISO_SUSP_HEADER *pnext;
 	struct buf *bp = NULL;
 	char *pwhead;
 	u_short c;
@@ -498,6 +499,21 @@ cd9660_rrip_loop(struct iso_directory_record *isodir, ISO_RRIP_ANALYZE *ana,
 		 * Note: "pend" should be more than one SUSP header
 		 */
 		while (pend >= phead + 1) {
+			/* Validate length. */
+			if (isonum_711(phead->length) < sizeof(*phead))
+				break;
+
+			/*
+			 * Next SUSP
+			 * Hopefully this works with newer versions, too
+			 */
+			pnext = (ISO_SUSP_HEADER *)((char *)phead +
+			    isonum_711(phead->length));
+
+			/* If the record doesn't fit, break out of the loop. */
+			if (pnext > pend)
+				break;
+
 			if (isonum_711(phead->version) == 1) {
 				for (ptable = table; ptable->func; ptable++) {
 					if (phead->type[0] == ptable->type[0] &&
@@ -513,14 +529,8 @@ cd9660_rrip_loop(struct iso_directory_record *isodir, ISO_RRIP_ANALYZE *ana,
 				result &= ~ISO_SUSP_STOP;
 				break;
 			}
-			/* plausibility check */
-			if (isonum_711(phead->length) < sizeof(*phead))
-				break;
-			/*
-			 * move to next SUSP
-			 * Hopefully this works with newer versions, too
-			 */
-			phead = (ISO_SUSP_HEADER *)((char *)phead + isonum_711(phead->length));
+
+			phead = pnext;
 		}
 
 		if (ana->fields && ana->iso_ce_len) {