|
From: Ben H. <be...@de...> - 2011-06-06 06:01:45
|
Extended VBLKs (those larger than the preset VBLK size) are divided into fragments, each with its own VBLK header. Our LDM implementation generally assumes that each VBLK is contiguous in memory, so these fragments must be assembled before further processing. Currently the reassembly seems to be done quite wrongly - no VBLK header is copied into the contiguous buffer, and the length of the header is subtracted twice from each fragment. Also the total length of the reassembled VBLK is calculated incorrectly. Signed-off-by: Ben Hutchings <be...@de...> --- This is purely based on a little code review after seeing the patch for CVE-2011-1017, and a quick look at the reverse-engineered documentation of LDM. I have no test case for it, but I suspect that you can force Windows to create an extended VBLK by giving a partition a very long name. Ben. fs/partitions/ldm.c | 10 +++++++--- 1 files changed, 7 insertions(+), 3 deletions(-) diff --git a/fs/partitions/ldm.c b/fs/partitions/ldm.c index af9fdf0..52271a6 100644 --- a/fs/partitions/ldm.c +++ b/fs/partitions/ldm.c @@ -1348,10 +1348,11 @@ found: f->map |= (1 << rec); + if (rec == 0) + memcpy(f->data, data, VBLK_SIZE_HEAD); data += VBLK_SIZE_HEAD; size -= VBLK_SIZE_HEAD; - - memcpy (f->data+rec*(size-VBLK_SIZE_HEAD)+VBLK_SIZE_HEAD, data, size); + memcpy(f->data + VBLK_SIZE_HEAD + rec * size, data, size); return true; } @@ -1401,7 +1402,10 @@ static bool ldm_frag_commit (struct list_head *frags, struct ldmdb *ldb) return false; } - if (!ldm_ldmdb_add (f->data, f->num*ldb->vm.vblk_size, ldb)) + if (!ldm_ldmdb_add(f->data, + VBLK_SIZE_HEAD + f->num * + (ldb->vm.vblk_size - VBLK_SIZE_HEAD), + ldb)) return false; /* Already logged */ } return true; -- 1.7.5.3 |
