Hi, i created another bad ISO which i expect to lead to an endless loop in existing GRUB (i.e. before applying the proposed change).
Both ISOs can be downloaded as gzip-compressed files now: http://scdbackup.webframe.org/ce_loop.iso.gz SHA256: d86b73b0cc260968f50c30a5207b798f5fc2396233aee5eb3cedf9cef069f3c2 http://scdbackup.webframe.org/ce_loop2.iso.gz SHA256: a6bde0c1562de8959d783bca0a79ad750da2bc129bdea2362b4a7c3e83426b2c They are smaller than 1 KB and expand to 128 KiB, each. (Please do not load these ISOs into existing xorriso programs by commands like -indev. ce_loop.iso leads to SIGSEGV. ce_loop2.iso leads to an endless loop. The libisofs code fix is only in git for now.) ------------------------------------------------------------------------ Test proposals for GRUB: If reading ce_loop.iso by GRUB leads to an error message, then my proposed change is in effect and protected against endless loops. Original GRUB is supposed to just ignore that situation, because it skips over the CE entry by mistake. If reading ce_loop2.iso by GRUB leads to an error message, then the proposed safety precaution against endless loops is in effect. I expect unpatched GRUB to loop endlessly with this ISO. ------------------------------------------------------------------------ About the production of ce_loop2.iso: The CE entry of its file /x points to a dummy SUSP entry XY of length 8 which sits directly before the CE entry. So this dummy entry is the first to be read by GRUB from the pseudo-contination area, gets processed by the hook() function (with no side effects), and is then followed by the CE entry. Because of the existence of the XY entry, i expect the CE entry not to be skipped by existing GRUB. # Production begins by the bad ISO of January 9 where the CE entry # points to itself cp ce_loop.iso ce_loop2.iso # Cut out a copy of the bad CE entry dd if=ce_loop2.iso bs=1 skip=102734 count=28 of=ce_entry # After the CE entry is plenty of unused space in the same block. # The length of the directory entry of /x plus 8 will not exceed 255. # So put the copy back with an offset of 8 bytes. dd if=ce_entry bs=1 seek=102742 conv=notrunc of=ce_loop2.iso # Rename the old CE entry head to XY echo "XY" | dd bs=1 seek=102734 count=2 conv=notrunc of=ce_loop2.iso # Give it the length of 8 echo $'\x08' | dd bs=1 seek=102736 count=1 conv=notrunc of=ce_loop2.iso # Set in the new CE entry the continuation area length to 8 + 28 = 36 echo $'\x24' | dd bs=1 seek=102762 count=1 conv=notrunc of=ce_loop2.iso echo $'\x24' | dd bs=1 seek=102769 count=1 conv=notrunc of=ce_loop2.iso # Change the length of the directory record from 134 to 142 echo $'\x8e' | dd bs=1 seek=102628 count=1 conv=notrunc of=ce_loop2.iso The resulting bytes of the whole directory record of /x are then: 000190e0 : .. .. .. .. 8e 00 37 00 00 00 00 00 00 37 02 00 . . . . 7 7 102624 : ... ... ... ... 142 0 55 0 0 0 0 0 0 55 2 0 000190f0 : 00 00 00 00 00 02 7b 01 09 08 08 1c 00 00 00 00 { 102640 : 0 0 0 0 0 2 123 1 9 8 8 28 0 0 0 0 00019100 : 01 00 00 01 04 58 2e 3b 31 00 50 58 24 01 a4 81 X . ; 1 P X $ 102656 : 1 0 0 1 4 88 46 59 49 0 80 88 36 1 164 129 00019110 : 00 00 00 00 81 a4 01 00 00 00 00 00 00 01 e8 03 102672 : 0 0 0 0 129 164 1 0 0 0 0 0 0 1 232 3 00019120 : 00 00 00 00 03 e8 e8 03 00 00 00 00 03 e8 54 46 T F 102688 : 0 0 0 0 3 232 232 3 0 0 0 0 3 232 84 70 00019130 : 1a 01 0e 7b 01 09 08 08 1c 00 7b 01 09 08 08 2f { { / 102704 : 26 1 14 123 1 9 8 8 28 0 123 1 9 8 8 47 00019140 : 00 7b 01 09 08 08 1c 00 4e 4d 06 01 00 78 58 59 { N M x X Y 102720 : 0 123 1 9 8 8 28 0 78 77 6 1 0 120 88 89 00019150 : 08 01 32 00 00 00 43 45 1c 01 32 00 00 00 00 00 2 C E 2 102736 : 8 1 50 0 0 0 67 69 28 1 50 0 0 0 0 0 00019160 : 00 32 4e 01 00 00 00 00 01 4e 24 00 00 00 00 00 2 N N $ 102752 : 0 50 78 1 0 0 0 0 1 78 36 0 0 0 0 0 00019170 : 00 24 .. .. .. .. .. .. .. .. .. .. .. .. .. .. $ . . . . . . . . . . . . . . 102768 : 0 36 ... ... ... ... ... ... ... ... ... ... ... ... ... ... ------------------------------------------------------------------------ Have a nice day :) Thomas _______________________________________________ Grub-devel mailing list Grub-devel@gnu.org https://lists.gnu.org/mailman/listinfo/grub-devel
