Hello Abdelrahman,
Thanks for your patch.
On 22.10.24 18:27, Abdelrahman Youssef wrote:
> The buffer gets allocated with the block device of size SECTOR_SIZE, but an
I guess you meant to say here "with the length of the block device's sector size".
> ill-formed GPT header_size may exceed it resulting in heap-overflow.
Nice catch. Been there since nearly 10 years too:
Fixes: 760689e5ccf1 ("disk: partitions: add EFI GUID Partition Table")
> Signed-off-by: Abdelrahman Youssef <abdelrahmanyossef12@xxxxxxxxx>
Reviewed-by: Ahmad Fatoum <a.fatoum@xxxxxxxxxxxxxx>
Cheers,
Ahmad
> ---
> common/partitions/efi.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/common/partitions/efi.c b/common/partitions/efi.c
> index 829360da6e..9a04b7014d 100644
> --- a/common/partitions/efi.c
> +++ b/common/partitions/efi.c
> @@ -173,6 +173,9 @@ static int is_gpt_valid(struct block_device *blk, u64 lba,
> goto fail;
> }
>
> + if (le32_to_cpu((*gpt)->header_size) > bdev_logical_block_size(blk))
> + goto fail;
> +
> /* Check the GUID Partition Table CRC */
> origcrc = le32_to_cpu((*gpt)->header_crc32);
> (*gpt)->header_crc32 = 0;
--
Pengutronix e.K. | |
Steuerwalder Str. 21 | http://www.pengutronix.de/ |
31137 Hildesheim, Germany | Phone: +49-5121-206917-0 |
Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
