Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2024-06-16 09:31:51 +00:00
Code Issues Packages Projects Releases Wiki Activity

[FSTUB] Fix out of bounds access in IoReadDiskSignature

Browse source 
- Convert PARTITION_TABLE_OFFSET to the number of bytes instead of
  (number of bytes) / 2. This avoids many confusing casts
- Use a cache aligned buffer for MBR
This commit is contained in:
Victor Perevertkin 2020-12-07 14:43:34 +03:00
parent 5d4ece342c
commit 8d2fe54188
No known key found for this signature in database
GPG key ID: C750B7222E9C7830
3 changed files with 22 additions and 28 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

31
ntoskrnl/fstub/disksup.c
View file

@ -1712,8 +1712,7 @@ xHalExamineMBR(IN PDEVICE_OBJECT DeviceObject,
}
/* Get the partition entry */
PartitionDescriptor = (PPARTITION_DESCRIPTOR)
&(((PUSHORT)Buffer)[PARTITION_TABLE_OFFSET]);
PartitionDescriptor = (PPARTITION_DESCRIPTOR)&Buffer[PARTITION_TABLE_OFFSET];
/* Make sure it's what the caller wanted */
if (PartitionDescriptor->PartitionType != MbrTypeIdentifier)
@ -1831,7 +1830,7 @@ xHalIoReadPartitionTable(IN PDEVICE_OBJECT DeviceObject,
DiskGeometryEx.DiskSize, MaxSector);
/* Allocate our buffer */
Buffer = ExAllocatePoolWithTag(NonPagedPool, InputSize, TAG_FILE_SYSTEM);
Buffer = ExAllocatePoolWithTag(NonPagedPoolCacheAligned, InputSize, TAG_FILE_SYSTEM);
if (!Buffer)
{
/* Fail, free the input buffer */
@ -1901,12 +1900,11 @@ xHalIoReadPartitionTable(IN PDEVICE_OBJECT DeviceObject,
if (!Offset.QuadPart)
{
/* Then read the signature off the disk */
(*PartitionBuffer)->Signature = ((PULONG)Buffer)[PARTITION_TABLE_OFFSET / 2 - 1];
(*PartitionBuffer)->Signature = *(PUINT32)&Buffer[DISK_SIGNATURE_OFFSET];
}
/* Get the partition descriptor array */
PartitionDescriptor = (PPARTITION_DESCRIPTOR)
&(((PUSHORT)Buffer)[PARTITION_TABLE_OFFSET]);
PartitionDescriptor = (PPARTITION_DESCRIPTOR)&Buffer[PARTITION_TABLE_OFFSET];
/* Start looping partitions */
j++;
@ -2091,8 +2089,7 @@ xHalIoReadPartitionTable(IN PDEVICE_OBJECT DeviceObject,
Offset.QuadPart = 0;
/* Go back to the descriptor array and loop it */
PartitionDescriptor = (PPARTITION_DESCRIPTOR)
&(((PUSHORT)Buffer)[PARTITION_TABLE_OFFSET]);
PartitionDescriptor = (PPARTITION_DESCRIPTOR)&Buffer[PARTITION_TABLE_OFFSET];
for (Entry = 1; Entry <= NUM_PARTITION_TABLE_ENTRIES; Entry++, PartitionDescriptor++)
{
/* Check if this is a container partition, since we skipped them */
@ -2237,7 +2234,7 @@ xHalIoSetPartitionInformation(IN PDEVICE_OBJECT DeviceObject,
}
/* Allocate our partition buffer */
Buffer = ExAllocatePoolWithTag(NonPagedPool, PAGE_SIZE, TAG_FILE_SYSTEM);
Buffer = ExAllocatePoolWithTag(NonPagedPoolCacheAligned, PAGE_SIZE, TAG_FILE_SYSTEM);
if (!Buffer) return STATUS_INSUFFICIENT_RESOURCES;
/* Initialize the event we'll use and loop partitions */
@ -2290,8 +2287,7 @@ xHalIoSetPartitionInformation(IN PDEVICE_OBJECT DeviceObject,
}
/* Get the partition descriptors and loop them */
PartitionDescriptor = (PPARTITION_DESCRIPTOR)
&(((PUSHORT)Buffer)[PARTITION_TABLE_OFFSET]);
PartitionDescriptor = (PPARTITION_DESCRIPTOR)&Buffer[PARTITION_TABLE_OFFSET];
for (Entry = 1; Entry <= NUM_PARTITION_TABLE_ENTRIES; Entry++, PartitionDescriptor++)
{
/* Check if it's unused or a container partition */
@ -2352,8 +2348,7 @@ xHalIoSetPartitionInformation(IN PDEVICE_OBJECT DeviceObject,
if (Entry <= NUM_PARTITION_TABLE_ENTRIES) break;
/* Nothing found yet, get the partition array again */
PartitionDescriptor = (PPARTITION_DESCRIPTOR)
&(((PUSHORT)Buffer)[PARTITION_TABLE_OFFSET]);
PartitionDescriptor = (PPARTITION_DESCRIPTOR)&Buffer[PARTITION_TABLE_OFFSET];
for (Entry = 1; Entry <= NUM_PARTITION_TABLE_ENTRIES; Entry++, PartitionDescriptor++)
{
/* Check if this was a container partition (we skipped these) */
@ -2469,7 +2464,7 @@ xHalIoWritePartitionTable(IN PDEVICE_OBJECT DeviceObject,
DiskLayout->TableCount = (PartitionBuffer->PartitionCount + NUM_PARTITION_TABLE_ENTRIES - 1) / NUM_PARTITION_TABLE_ENTRIES;
/* Allocate our partition buffer */
Buffer = ExAllocatePoolWithTag(NonPagedPool, PAGE_SIZE, TAG_FILE_SYSTEM);
Buffer = ExAllocatePoolWithTag(NonPagedPoolCacheAligned, PAGE_SIZE, TAG_FILE_SYSTEM);
if (!Buffer) return STATUS_INSUFFICIENT_RESOURCES;
/* Loop the entries */
@ -2520,7 +2515,7 @@ xHalIoWritePartitionTable(IN PDEVICE_OBJECT DeviceObject,
if (!IsSuperFloppy)
{
/* Set the boot record signature */
Buffer[BOOT_SIGNATURE_OFFSET] = BOOT_RECORD_SIGNATURE;
((PUSHORT)Buffer)[BOOT_SIGNATURE_OFFSET] = BOOT_RECORD_SIGNATURE;
/* By default, don't require a rewrite */
DoRewrite = FALSE;
@ -2529,12 +2524,10 @@ xHalIoWritePartitionTable(IN PDEVICE_OBJECT DeviceObject,
if (!Offset.QuadPart)
{
/* Check if the signature doesn't match */
if (((PULONG)Buffer)[PARTITION_TABLE_OFFSET / 2 - 1] !=
PartitionBuffer->Signature)
if (*(PUINT32)&Buffer[PARTITION_TABLE_OFFSET] != PartitionBuffer->Signature)
{
/* Then write the signature and now we need a rewrite */
((PULONG)Buffer)[PARTITION_TABLE_OFFSET / 2 - 1] =
PartitionBuffer->Signature;
*(PUINT32)&Buffer[PARTITION_TABLE_OFFSET] = PartitionBuffer->Signature;
DoRewrite = TRUE;
}
}

12
ntoskrnl/fstub/fstubex.c
View file

@ -674,7 +674,7 @@ FstubDetectPartitionStyle(IN PDISK_INFORMATION Disk,
/* Get the partition descriptor array */
PartitionDescriptor = (PPARTITION_DESCRIPTOR)
&(Disk->Buffer[PARTITION_TABLE_OFFSET]);
&(Disk->Buffer[PARTITION_TABLE_OFFSET / sizeof(Disk->Buffer[0])]);
/* If we have not the 0xAA55 then it's raw partition */
if (Disk->Buffer[BOOT_SIGNATURE_OFFSET] != BOOT_RECORD_SIGNATURE)
{
@ -2140,7 +2140,7 @@ IoReadDiskSignature(IN PDEVICE_OBJECT DeviceObject,
IN ULONG BytesPerSector,
OUT PDISK_SIGNATURE Signature)
{
PULONG Buffer;
PUCHAR Buffer;
NTSTATUS Status;
ULONG HeaderCRC32, i, CheckSum;
PEFI_PARTITION_HEADER EFIHeader;
@ -2207,7 +2207,7 @@ IoReadDiskSignature(IN PDEVICE_OBJECT DeviceObject,
/* Then zero the one in EFI header. This is needed to compute header checksum */
EFIHeader->HeaderCRC32 = 0;
/* Compute header checksum and compare with the one present in partition table */
if (RtlComputeCrc32(0, (PUCHAR)Buffer, sizeof(EFI_PARTITION_HEADER)) != HeaderCRC32)
if (RtlComputeCrc32(0, Buffer, sizeof(EFI_PARTITION_HEADER)) != HeaderCRC32)
{
Status = STATUS_DISK_CORRUPT_ERROR;
goto Cleanup;
@ -2220,14 +2220,14 @@ IoReadDiskSignature(IN PDEVICE_OBJECT DeviceObject,
else
{
/* Compute MBR checksum */
for (i = 0, CheckSum = 0; i < 512 / sizeof(ULONG) ; i++)
for (i = 0, CheckSum = 0; i < BytesPerSector / sizeof(UINT32); i++)
{
CheckSum += Buffer[i];
CheckSum += *(PUINT32)&Buffer[i];
}
/* Set partition table style to MBR and return signature (offset 440) and checksum */
Signature->PartitionStyle = PARTITION_STYLE_MBR;
Signature->Mbr.Signature = Buffer[PARTITION_TABLE_OFFSET / 2 - 1];
Signature->Mbr.Signature = *(PUINT32)&Buffer[DISK_SIGNATURE_OFFSET];
Signature->Mbr.CheckSum = CheckSum;
}

7
ntoskrnl/include/internal/hal.h
View file

@ -240,9 +240,10 @@ xKdUnmapVirtualAddress(
//
// Various offsets in the boot record
//
#define PARTITION_TABLE_OFFSET (0x1BE / 2)
#define BOOT_SIGNATURE_OFFSET ((0x200 / 2) - 1)
#define BOOT_RECORD_RESERVED 0x1BC
#define DISK_SIGNATURE_OFFSET 0x1B8
#define PARTITION_TABLE_OFFSET 0x1BE
#define BOOT_SIGNATURE_OFFSET ((0x200 / sizeof(INT16)) - 1)
#define BOOT_RECORD_SIGNATURE 0xAA55
#define NUM_PARTITION_TABLE_ENTRIES 4