[src/trunk]: src/sys/fs/hfs fs/hfs: Avoid buffer overrun in hfslib_reada_node...

[riastradh <riastradh%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/536cfd9a5ab5
branches:  trunk
changeset: 373803:536cfd9a5ab5
user:      riastradh <riastradh%NetBSD.org@localhost>
date:      Wed Mar 01 16:21:14 2023 +0000

description:
fs/hfs: Avoid buffer overrun in hfslib_reada_node_offsets.

XXX pullup-8
XXX pullup-9
XXX pullup-10

diffstat:

 sys/fs/hfs/libhfs.c |  11 +++++++----
 sys/fs/hfs/libhfs.h |   4 ++--
 2 files changed, 9 insertions(+), 6 deletions(-)

diffs (64 lines):

diff -r 36cd376527a8 -r 536cfd9a5ab5 sys/fs/hfs/libhfs.c
--- a/sys/fs/hfs/libhfs.c       Wed Mar 01 15:45:00 2023 +0000
+++ b/sys/fs/hfs/libhfs.c       Wed Mar 01 16:21:14 2023 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: libhfs.c,v 1.15 2018/12/30 22:40:00 sevan Exp $        */
+/*     $NetBSD: libhfs.c,v 1.16 2023/03/01 16:21:14 riastradh Exp $    */
 
 /*-
  * Copyright (c) 2005, 2007 The NetBSD Foundation, Inc.
@@ -47,7 +47,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: libhfs.c,v 1.15 2018/12/30 22:40:00 sevan Exp $");
+__KERNEL_RCSID(0, "$NetBSD: libhfs.c,v 1.16 2023/03/01 16:21:14 riastradh Exp $");
 
 #include "libhfs.h"
 
@@ -1477,7 +1477,7 @@
                HFS_LIBERR("could not allocate node records");
 
        last_bytes_read = hfslib_reada_node_offsets((uint8_t*)in_bytes + nodesize -
-                       numrecords * sizeof(uint16_t), rec_offsets);
+                       numrecords * sizeof(uint16_t), rec_offsets, numrecords);
        if (last_bytes_read == 0)
                HFS_LIBERR("could not read node record offsets");
 
@@ -1566,7 +1566,8 @@
  *     in reverse order. Does not read the free space offset.
  */
 size_t
-hfslib_reada_node_offsets(void* in_bytes, uint16_t* out_offset_array)
+hfslib_reada_node_offsets(void* in_bytes, uint16_t* out_offset_array,
+    uint16_t numrecords)
 {
        void*           ptr;
 
@@ -1583,6 +1584,8 @@
         */
        out_offset_array--;
        do {
+               if (numrecords-- == 0)
+                       return 0;
                out_offset_array++;
                *out_offset_array = be16tohp(&ptr);
        } while (*out_offset_array != (uint16_t)14);
diff -r 36cd376527a8 -r 536cfd9a5ab5 sys/fs/hfs/libhfs.h
--- a/sys/fs/hfs/libhfs.h       Wed Mar 01 15:45:00 2023 +0000
+++ b/sys/fs/hfs/libhfs.h       Wed Mar 01 16:21:14 2023 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: libhfs.h,v 1.8 2019/01/05 10:25:11 maya Exp $  */
+/*     $NetBSD: libhfs.h,v 1.9 2023/03/01 16:21:14 riastradh Exp $     */
 
 /*-
  * Copyright (c) 2005, 2007 The NetBSD Foundation, Inc.
@@ -585,7 +585,7 @@
        hfs_hfs_master_directory_block_t*);
 size_t hfslib_reada_node(void*, hfs_node_descriptor_t*, void***, uint16_t**,
        hfs_btree_file_type, hfs_volume*, hfs_callback_args*);
-size_t hfslib_reada_node_offsets(void*, uint16_t*);
+size_t hfslib_reada_node_offsets(void*, uint16_t*, uint16_t);
 size_t hfslib_read_header_node(void**, uint16_t*, uint16_t,
        hfs_header_record_t*, void*, void*);
 size_t hfslib_read_catalog_keyed_record(void*, hfs_catalog_keyed_record_t*,