[PATCH] ldm: Fix reassembly of extended VBLKs

classic Classic list List threaded Threaded
1 message Options
Reply | Threaded
Open this post in threaded view
|

[PATCH] ldm: Fix reassembly of extended VBLKs

Ben Hutchings-3
Extended VBLKs (those larger than the preset VBLK size) are divided
into fragments, each with its own VBLK header.  Our LDM implementation
generally assumes that each VBLK is contiguous in memory, so these
fragments must be assembled before further processing.

Currently the reassembly seems to be done quite wrongly - no VBLK
header is copied into the contiguous buffer, and the length of the
header is subtracted twice from each fragment.  Also the total
length of the reassembled VBLK is calculated incorrectly.

Signed-off-by: Ben Hutchings <[hidden email]>
---
This is purely based on a little code review after seeing the patch for
CVE-2011-1017, and a quick look at the reverse-engineered documentation
of LDM.  I have no test case for it, but I suspect that you can force
Windows to create an extended VBLK by giving a partition a very long
name.

Ben.

 fs/partitions/ldm.c |   10 +++++++---
 1 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/fs/partitions/ldm.c b/fs/partitions/ldm.c
index af9fdf0..52271a6 100644
--- a/fs/partitions/ldm.c
+++ b/fs/partitions/ldm.c
@@ -1348,10 +1348,11 @@ found:
 
  f->map |= (1 << rec);
 
+ if (rec == 0)
+ memcpy(f->data, data, VBLK_SIZE_HEAD);
  data += VBLK_SIZE_HEAD;
  size -= VBLK_SIZE_HEAD;
-
- memcpy (f->data+rec*(size-VBLK_SIZE_HEAD)+VBLK_SIZE_HEAD, data, size);
+ memcpy(f->data + VBLK_SIZE_HEAD + rec * size, data, size);
 
  return true;
 }
@@ -1401,7 +1402,10 @@ static bool ldm_frag_commit (struct list_head *frags, struct ldmdb *ldb)
  return false;
  }
 
- if (!ldm_ldmdb_add (f->data, f->num*ldb->vm.vblk_size, ldb))
+ if (!ldm_ldmdb_add(f->data,
+   VBLK_SIZE_HEAD + f->num *
+   (ldb->vm.vblk_size - VBLK_SIZE_HEAD),
+   ldb))
  return false; /* Already logged */
  }
  return true;
--
1.7.5.3



------------------------------------------------------------------------------
Simplify data backup and recovery for your virtual environment with vRanger.
Installation's a snap, and flexible recovery options mean your data is safe,
secure and there when you need it. Discover what all the cheering's about.
Get your free trial download today.
http://p.sf.net/sfu/quest-dev2dev2 
_______________________________________________
Linux-NTFS-Dev mailing list
[hidden email]
https://lists.sourceforge.net/lists/listinfo/linux-ntfs-dev