|
 |
d2fcd91 |
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
|
d2fcd91 |
From: Maxim Suhanov <dfirblog@gmail.com>
|
|
|
d2fcd91 |
Date: Tue, 3 Oct 2023 19:12:26 +0200
|
|
|
d2fcd91 |
Subject: [PATCH] fs/ntfs: Fix an OOB read when parsing bitmaps for index
|
|
|
d2fcd91 |
attributes
|
|
|
d2fcd91 |
|
|
|
d2fcd91 |
This fix introduces checks to ensure that bitmaps for directory indices
|
|
|
d2fcd91 |
are never read beyond their actual sizes.
|
|
|
d2fcd91 |
|
|
|
d2fcd91 |
The lack of this check is a minor issue, likely not exploitable in any way.
|
|
|
d2fcd91 |
|
|
|
d2fcd91 |
Reported-by: Maxim Suhanov <dfirblog@gmail.com>
|
|
|
d2fcd91 |
Signed-off-by: Maxim Suhanov <dfirblog@gmail.com>
|
|
|
d2fcd91 |
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
|
|
|
d2fcd91 |
---
|
|
|
d2fcd91 |
grub-core/fs/ntfs.c | 19 +++++++++++++++++++
|
|
|
d2fcd91 |
1 file changed, 19 insertions(+)
|
|
|
d2fcd91 |
|
|
|
d2fcd91 |
diff --git a/grub-core/fs/ntfs.c b/grub-core/fs/ntfs.c
|
|
|
d2fcd91 |
index 72302033281a..74515114287f 100644
|
|
|
d2fcd91 |
--- a/grub-core/fs/ntfs.c
|
|
|
d2fcd91 |
+++ b/grub-core/fs/ntfs.c
|
|
|
d2fcd91 |
@@ -839,6 +839,25 @@ grub_ntfs_iterate_dir (grub_fshelp_node_t dir,
|
|
|
d2fcd91 |
|
|
|
d2fcd91 |
if (is_resident)
|
|
|
d2fcd91 |
{
|
|
|
d2fcd91 |
+ if (bitmap_len > (at->mft->data->mft_size << GRUB_NTFS_BLK_SHR))
|
|
|
d2fcd91 |
+ {
|
|
|
d2fcd91 |
+ grub_error (GRUB_ERR_BAD_FS, "resident bitmap too large");
|
|
|
d2fcd91 |
+ goto done;
|
|
|
d2fcd91 |
+ }
|
|
|
d2fcd91 |
+
|
|
|
d2fcd91 |
+ if (cur_pos >= at->mft->buf + (at->mft->data->mft_size << GRUB_NTFS_BLK_SHR))
|
|
|
d2fcd91 |
+ {
|
|
|
d2fcd91 |
+ grub_error (GRUB_ERR_BAD_FS, "resident bitmap out of range");
|
|
|
d2fcd91 |
+ goto done;
|
|
|
d2fcd91 |
+ }
|
|
|
d2fcd91 |
+
|
|
|
d2fcd91 |
+ if (u16at (cur_pos, 0x14) + u32at (cur_pos, 0x10) >
|
|
|
d2fcd91 |
+ (grub_addr_t) at->mft->buf + (at->mft->data->mft_size << GRUB_NTFS_BLK_SHR) - (grub_addr_t) cur_pos)
|
|
|
d2fcd91 |
+ {
|
|
|
d2fcd91 |
+ grub_error (GRUB_ERR_BAD_FS, "resident bitmap out of range");
|
|
|
d2fcd91 |
+ goto done;
|
|
|
d2fcd91 |
+ }
|
|
|
d2fcd91 |
+
|
|
|
d2fcd91 |
grub_memcpy (bmp, cur_pos + u16at (cur_pos, 0x14),
|
|
|
d2fcd91 |
bitmap_len);
|
|
|
d2fcd91 |
}
|