NetBSD Problem Report #60577

From reinoud@gorilla.13thmonkey.org  Thu Aug 13 12:56:00 2026
Return-Path: <reinoud@gorilla.13thmonkey.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "mail.netbsd.org", Issuer "YR2" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id D626E1A923B
	for <gnats-bugs@gnats.NetBSD.org>; Thu, 13 Aug 2026 12:56:00 +0000 (UTC)
Message-Id: <20260813124949.951FC14D1EDA@gorilla.13thmonkey.org>
Date: Thu, 13 Aug 2026 14:49:49 +0200 (CEST)
From: reinoud@13thmonkey.org
Reply-To: reinoud@netbsd.org
To: gnats-bugs@NetBSD.org
Subject: local UDF buffer overflow with doctored image
X-Send-Pr-Version: 3.95
X-From4GNATS: "reinoud@13thmonkey.org via gnats" <gnats-admin@NetBSD.org>

>Number:         60577
>Category:       kern
>Synopsis:       local UDF buffer overflow with doctored image
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Aug 13 13:00:00 +0000 2026
>Last-Modified:  Sat Aug 22 13:15:37 +0000 2026
>Originator:     Reinoud Zandijk
>Release:        NetBSD 11.99.3
>Organization:

>Environment:


System: NetBSD gorilla.13thmonkey.org 11.99.3 NetBSD 11.99.3 (GENERIC) #1: Mon Nov 24 15:09:27 CET 2025 reinoud@gorilla.13thmonkey.org:/usr/sources/cvs.netbsd.org/src-clean/obj/sys/arch/amd64/compile/GENERIC amd64
Architecture: x86_64
Machine: amd64
>Description:

Small files can be stored inside the file descriptor. A doctored image with a
file descriptor containing an invalid extended attribute length or invalid
information length could lead to a buffer overflow.


>How-To-Repeat:

Provide a doctored image with a node that that is flagged for internal
recording of data and has the length of the internal extended attributes or
its in information length set to point outside the file descriptor.


>Fix:

Apply the following fix that explicitly tests these cases.

Index: sys/fs/udf/udf_subr.c
===================================================================
RCS file: /cvsroot/src/sys/fs/udf/udf_subr.c,v
retrieving revision 1.177
diff -u -p -r1.177 udf_subr.c
--- sys/fs/udf/udf_subr.c	28 Mar 2025 19:34:35 -0000	1.177
+++ sys/fs/udf/udf_subr.c	22 Aug 2026 13:09:08 -0000
@@ -6565,7 +6565,7 @@ udf_read_internal(struct udf_node *node,
 	struct file_entry     *fe = node->fe;
 	struct extfile_entry *efe = node->efe;
 	uint64_t inflen;
-	uint32_t sector_size;
+	uint32_t l_ea, srcoff, sector_size;
 	uint8_t  *srcpos;
 	int icbflags, addr_type;

@@ -6573,26 +6573,34 @@ udf_read_internal(struct udf_node *node,
 	ump = node->ump;
 	sector_size = ump->discinfo.sector_size;

-	/*
-	 * XXX there should be real bounds-checking logic here,
-	 * in case ->l_ea or ->inf_len contains nonsense.
-	 */
-
 	if (fe) {
 		inflen   = udf_rw64(fe->inf_len);
-		srcpos   = &fe->data[0] + udf_rw32(fe->l_ea);
+		l_ea     = udf_rw32(fe->l_ea);
+		srcoff   = offsetof(struct file_entry, data);
+		srcpos   = (uint8_t *) fe;
 		icbflags = udf_rw16(fe->icbtag.flags);
 	} else {
 		assert(node->efe);
 		inflen   = udf_rw64(efe->inf_len);
-		srcpos   = &efe->data[0] + udf_rw32(efe->l_ea);
+		l_ea     = udf_rw32(efe->l_ea);
+		srcoff   = offsetof(struct extfile_entry, data);
+		srcpos   = (uint8_t *) efe;
 		icbflags = udf_rw16(efe->icbtag.flags);
 	}
 	addr_type = icbflags & UDF_ICB_TAG_FLAGS_ALLOC_MASK;

 	assert(addr_type == UDF_ICB_INTERN_ALLOC);
 	__USE(addr_type);
-	assert(inflen < sector_size);
+
+	/*
+	 * Bound-check ->l_ea + ->inf_len to prevent buffer overflow.
+	 */
+	if ((l_ea > sector_size - srcoff) ||
+			(inflen > sector_size - srcoff - l_ea)) {
+		memset(blob, 0, sector_size);
+		return EINVAL;
+	}
+	srcpos += srcoff + l_ea;

 	/* copy out info */
 	memcpy(blob, srcpos, inflen);


>Release-Note:

>Audit-Trail:

>Unformatted:

Home	PR Database Search