[Bug 272896] cd9660_rrip_*() can read beyond the end of a buf

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=272896

John Baldwin <jhb@FreeBSD.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|Open                        |In Progress
           Assignee|bugs@FreeBSD.org            |jhb@FreeBSD.org

--- Comment #1 from John Baldwin <jhb@FreeBSD.org> ---
I've uploaded a patch that adds an extra check to cd9660_rrip_loop() to ensure
that the entire extension structure is in bounds (not just the header) which
mitigates the reproducer here:  https://reviews.freebsd.org/D57135

I've also added a followup change to fix the various handlers to ensure that
the length reported in the header is long enough to cover the data they read
from the structure.  A few places were doing this before (such as symlink
handling) though I'm not sure it was always consistent.  The changes for this
are at https://reviews.freebsd.org/D57136

There is one other potential set of checks we could make which is to reject
duplicate attributes if they show up, but I think those will not result in a
crash, just that later attributes might overwrite (or append to!) previous
values.

-- 
You are receiving this mail because:
You are the assignee for the bug.