bug#76648: Crash trying to parse nilfs2 superblock
"Butenko, Anton" via Bug reports for the GNU Parted disk partition editor <[email protected]> Fri, 28 Feb 2025 15:21:00 +0000
| Newsgroups | gmane.comp.gnu.parted.bugs |
|---|---|
| Message-ID | <BYAPR17MB2151C500C91AABDF0495CE19B6CC2@BYAPR17MB2151.namprd17.prod.outlook.com> |
--_000_BYAPR17MB2151C500C91AABDF0495CE19B6CC2BYAPR17MB2151namp_
Content-Type: text/plain; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable
Hello,
I was checking how good is fix of
https://debbugs.gnu.org/cgi/bugreport.cgi?bug=3D34392
=93Avoid sigsegv in case 2nd nilfs2 superblock magic accidently found.=94
In systemd, libblkid and parted and found a slight possibility of crash in =
parted regarding to the changes in the referred bug.
The parted fix includes a chance to crash in case of nilfs2 superblock havi=
ng correct magic, but corrupted =93bytes=94 field (value in range from 12 t=
o 20).
I=92ve modified the code to avoid the sigsegv and align implementation with=
the libblkid implementation:
https://github.com/util-linux/util-linux/commit/ac681a310c32319423297544833=
932f4d689a7a2
And modified t4301-nilfs2-badsb2.sh test code to trigger this case as well =
as the previously reported one.
I've attached a patch with my modifications. Can you, please, look at it?
Regards,
Anton Butenko
--_000_BYAPR17MB2151C500C91AABDF0495CE19B6CC2BYAPR17MB2151namp_
Content-Type: text/html; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable
<html xmlns:o=3D"urn:schemas-microsoft-com:office:office" xmlns:w=3D"urn:sc=
hemas-microsoft-com:office:word" xmlns:m=3D"http://schemas.microsoft.com/of=
fice/2004/12/omml" xmlns=3D"http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DWindows-1=
252">
<meta name=3D"Generator" content=3D"Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Aptos;
panose-1:2 11 0 4 2 2 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Aptos",sans-serif;
mso-ligatures:standardcontextual;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#467886;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Aptos",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:11.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang=3D"EN-US" link=3D"#467886" vlink=3D"#96607D" style=3D"word-wrap:=
break-word">
<div class=3D"WordSection1">
<p class=3D"MsoNormal">Hello,<o:p></o:p></p>
<p class=3D"MsoNormal"><o:p> </o:p></p>
<p class=3D"MsoNormal">I was checking how good is fix of<br>
<br>
<a href=3D"https://debbugs.gnu.org/cgi/bugreport.cgi?bug=3D34392">https://d=
ebbugs.gnu.org/cgi/bugreport.cgi?bug=3D34392</a><br>
=93Avoid sigsegv in case 2nd nilfs2 superblock magic accidently found.=94<b=
r>
<br>
<o:p></o:p></p>
<p class=3D"MsoNormal">In systemd, libblkid and parted and found a slight p=
ossibility of crash in parted regarding to the changes in the referred bug.=
<br>
The parted fix includes a chance to crash in case of nilfs2 superblock havi=
ng correct magic, but corrupted =93bytes=94 field (value in range from 12 t=
o 20).<br>
<br>
I=92ve modified the code to avoid the sigsegv and align implementation with=
the libblkid implementation:<br>
<a href=3D"https://github.com/util-linux/util-linux/commit/ac681a310c323194=
23297544833932f4d689a7a2">https://github.com/util-linux/util-linux/commit/a=
c681a310c32319423297544833932f4d689a7a2</a><br>
And modified t4301-nilfs2-badsb2.sh test code to trigger this case as well =
as the previously reported one.<br>
<br>
I've attached a patch with my modifications. Can you, please, look at it?<b=
r>
<br>
Regards,<br>
Anton Butenko<o:p></o:p></p>
</div>
</body>
</html>
--_000_BYAPR17MB2151C500C91AABDF0495CE19B6CC2BYAPR17MB2151namp_--