Print this page
7804 fdisk_read_master_part_table() causes 'format' to crash
Reviewed by: Jason King <jason.brian.king@gmail.com>
Reviewed by: Hans Rosenfeld <hans.rosenfeld@nexenta.com>
Reviewed by: Robert Mustacchi <rm@joyent.com>

Split Close
Expand all
Collapse all
          --- old/usr/src/lib/libfdisk/common/libfdisk.c
          +++ new/usr/src/lib/libfdisk/common/libfdisk.c
↓ open down ↓ 12 lines elided ↑ open up ↑
  13   13   * When distributing Covered Code, include this CDDL HEADER in each
  14   14   * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15   15   * If applicable, add the following below this CDDL HEADER, with the
  16   16   * fields enclosed by brackets "[]" replaced with your own identifying
  17   17   * information: Portions Copyright [yyyy] [name of copyright owner]
  18   18   *
  19   19   * CDDL HEADER END
  20   20   */
  21   21  /*
  22   22   * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
       23 + * Copyright 2017 The MathWorks, Inc.  All rights reserved.
  23   24   */
  24   25  
  25   26  #include <stdio.h>
  26   27  #include <stdlib.h>
  27   28  #include <string.h>
  28   29  #include <strings.h>
  29   30  #include <unistd.h>
  30   31  #include <errno.h>
  31   32  #include <fcntl.h>
  32   33  #include <ctype.h>
↓ open down ↓ 728 lines elided ↑ open up ↑
 761  762  }
 762  763  
 763  764  /*
 764  765   * Reads the master fdisk partition table from the device assuming that it has
 765  766   * a valid table.
 766  767   * MBR is supposed to be of 512 bytes no matter what the device block size is.
 767  768   */
 768  769  static int
 769  770  fdisk_read_master_part_table(ext_part_t *epp)
 770  771  {
 771      -        uchar_t buf[512];
 772      -        int sectsize = 512;
      772 +        struct dk_minfo_ext dkmp_ext;
      773 +        uchar_t *buf;
      774 +        int sectsize;
 773  775          int size = sizeof (struct ipart);
 774  776          int cpcnt = FD_NUMPART * size;
 775  777  
 776  778          if (lseek(epp->dev_fd, 0, SEEK_SET) < 0) {
 777  779                  return (EIO);
 778  780          }
      781 +        if (ioctl(epp->dev_fd, DKIOCGMEDIAINFOEXT, &dkmp_ext) < 0) {
      782 +                return (EIO);
      783 +        }
      784 +        if (dkmp_ext.dki_lbsize < 512) {
      785 +                return (EIO);
      786 +        }
      787 +        sectsize = dkmp_ext.dki_lbsize;
      788 +        buf = calloc(sectsize, sizeof (uchar_t));
      789 +        if (buf == NULL) {
      790 +                return (ENOMEM);
      791 +        }
 779  792          if (read(epp->dev_fd, buf, sectsize) < sectsize) {
      793 +                free(buf);
 780  794                  return (EIO);
 781  795          }
 782  796  
 783  797          /*LINTED*/
 784  798          if (LE_16((*(uint16_t *)&buf[510])) != MBB_MAGIC) {
 785  799                  bzero(epp->mtable, cpcnt);
      800 +                free(buf);
 786  801                  return (FDISK_EBADMAGIC);
 787  802          }
 788  803  
 789  804          bcopy(&buf[FDISK_PART_TABLE_START], epp->mtable, cpcnt);
      805 +        free(buf);
 790  806  
 791  807          return (FDISK_SUCCESS);
 792  808  }
 793  809  
 794  810  int
 795  811  fdisk_ext_part_exists(ext_part_t *epp)
 796  812  {
 797  813          int i;
 798  814          struct ipart *part_table = epp->mtable;
 799  815  
↓ open down ↓ 594 lines elided ↑ open up ↑
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX