1From 232e2f4fd9a24bf08215ddc8c53ccadffc841fb5 Mon Sep 17 00:00:00 2001 2From: Paul Emge <paulemge@forallsecure.com> 3Date: Mon, 8 Jul 2019 16:37:03 -0700 4Subject: [PATCH] CVE-2019-13103: disk: stop infinite recursion in DOS 5 Partitions 6 7part_get_info_extended and print_partition_extended can recurse infinitely 8while parsing a self-referential filesystem or one with a silly number of 9extended partitions. This patch adds a limit to the number of recursive 10partitions. 11 12Signed-off-by: Paul Emge <paulemge@forallsecure.com> 13--- 14 disk/part_dos.c | 18 ++++++++++++++++++ 15 1 file changed, 18 insertions(+) 16 17diff --git a/disk/part_dos.c b/disk/part_dos.c 18index 936cee0..aae9d95 100644 19--- a/disk/part_dos.c 20+++ b/disk/part_dos.c 21@@ -23,6 +23,10 @@ 22 23 #define DOS_PART_DEFAULT_SECTOR 512 24 25+/* should this be configurable? It looks like it's not very common at all 26+ * to use large numbers of partitions */ 27+#define MAX_EXT_PARTS 256 28+ 29 /* Convert char[4] in little endian format to the host format integer 30 */ 31 static inline unsigned int le32_to_int(unsigned char *le32) 32@@ -126,6 +130,13 @@ static void print_partition_extended(struct blk_desc *dev_desc, 33 dos_partition_t *pt; 34 int i; 35 36+ /* set a maximum recursion level */ 37+ if (part_num > MAX_EXT_PARTS) 38+ { 39+ printf("** Nested DOS partitions detected, stopping **\n"); 40+ return; 41+ } 42+ 43 if (blk_dread(dev_desc, ext_part_sector, 1, (ulong *)buffer) != 1) { 44 printf ("** Can't read partition table on %d:" LBAFU " **\n", 45 dev_desc->devnum, ext_part_sector); 46@@ -191,6 +202,13 @@ static int part_get_info_extended(struct blk_desc *dev_desc, 47 int i; 48 int dos_type; 49 50+ /* set a maximum recursion level */ 51+ if (part_num > MAX_EXT_PARTS) 52+ { 53+ printf("** Nested DOS partitions detected, stopping **\n"); 54+ return -1; 55+ } 56+ 57 if (blk_dread(dev_desc, ext_part_sector, 1, (ulong *)buffer) != 1) { 58 printf ("** Can't read partition table on %d:" LBAFU " **\n", 59 dev_desc->devnum, ext_part_sector); 60-- 611.9.1 62 63