From ddf77ec392717e7eaf278c0f201b561afac97b87 Mon Sep 17 00:00:00 2001 From: Ed Maste Date: Tue, 3 May 2022 16:13:37 -0400 Subject: [PATCH] etdump: exit on error if section header or entry offset is OOB PR: 263663 Reported by: Robert Morris Reviewed by: markj MFC after: 1 week Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D35868 --- usr.bin/etdump/etdump.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/usr.bin/etdump/etdump.c b/usr.bin/etdump/etdump.c index e536aa5e51cb..b234fc9d7ff8 100644 --- a/usr.bin/etdump/etdump.c +++ b/usr.bin/etdump/etdump.c @@ -116,8 +116,8 @@ boot_catalog_valid(char *entry) } static int -dump_section(char *buffer, size_t offset, FILE *outfile, const char *filename, - struct outputter *outputter) +dump_section(char *buffer, size_t bufsize, size_t offset, FILE *outfile, + const char *filename, struct outputter *outputter) { boot_catalog_section_header *sh; u_char platform_id; @@ -125,6 +125,8 @@ dump_section(char *buffer, size_t offset, FILE *outfile, const char *filename, size_t entry_offset; boot_catalog_section_entry *entry; + if (offset + sizeof(boot_catalog_section_header) > bufsize) + errx(1, "%s: section header out of bounds", filename); sh = (boot_catalog_section_header *)&buffer[offset]; if (outputter->output_section != NULL) { outputter->output_section(outfile, filename, sh); @@ -135,6 +137,10 @@ dump_section(char *buffer, size_t offset, FILE *outfile, const char *filename, if (outputter->output_entry != NULL) { for (i = 1; i <= (int)sh->num_section_entries[0]; i++) { entry_offset = offset + i * ET_BOOT_ENTRY_SIZE; + if (entry_offset + sizeof(boot_catalog_section_entry) > + bufsize) + errx(1, "%s: section entry out of bounds", + filename); entry = (boot_catalog_section_entry *)&buffer[entry_offset]; outputter->output_entry(outfile, filename, entry, @@ -195,8 +201,8 @@ dump_eltorito(FILE *iso, const char *filename, FILE *outfile, (uint8_t)entry[0] != ET_SECTION_HEADER_LAST) break; - entry_count = dump_section(buffer, offset, outfile, filename, - outputter); + entry_count = dump_section(buffer, sizeof(buffer), offset, + outfile, filename, outputter); offset += entry_count * ET_BOOT_ENTRY_SIZE; }