Skip to main content

Browse the archive

https://github.com/torvalds/linux
27 March 2024, 02:37:15 UTC
Revision 1eafbfeb7bdf59cfe173304c76188f3fd5f1fd05 authored by Timo Warns on 14 March 2011, 13:59:33 UTC, committed by Linus Torvalds on 14 March 2011, 17:14:28 UTC 
Fix corrupted OSF partition table parsing
 
The kernel automatically evaluates partition tables of storage devices.
The code for evaluating OSF partitions contains a bug that leaks data
from kernel heap memory to userspace for certain corrupted OSF
partitions.

In more detail:

  for (i = 0 ; i < le16_to_cpu(label->d_npartitions); i++, partition++) {

iterates from 0 to d_npartitions - 1, where d_npartitions is read from
the partition table without validation and partition is a pointer to an
array of at most 8 d_partitions.

Add the proper and obvious validation.

Signed-off-by: Timo Warns <warns@pre-sense.de>
Cc: stable@kernel.org
[ Changed the patch trivially to not repeat the whole le16_to_cpu()
  thing, and to use an explicit constant for the magic value '8' ]
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
1 parent 2fbfac4
History
Tip revision: 1eafbfeb7bdf59cfe173304c76188f3fd5f1fd05 authored by Timo Warns on 14 March 2011, 13:59:33 UTC
Fix corrupted OSF partition table parsing
Tip revision: 1eafbfe
File Mode Size
Documentation
arch
block
crypto
drivers
firmware
fs
include
init
ipc
kernel
lib
mm
net
samples
scripts
security
sound
tools
usr
virt
.gitignore -rw-r--r-- 941 bytes
.mailmap -rw-r--r-- 4.0 KB
COPYING -rw-r--r-- 18.3 KB
CREDITS -rw-r--r-- 91.7 KB
Kbuild -rw-r--r-- 2.4 KB
Kconfig -rw-r--r-- 252 bytes
MAINTAINERS -rw-r--r-- 187.2 KB
Makefile -rw-r--r-- 50.9 KB
README -rw-r--r-- 17.1 KB
REPORTING-BUGS -rw-r--r-- 3.3 KB

README

back to top