Re: Possible memory fault in fs/iso9660 (correction)

2022-12-12 Thread Daniel Kiper
Hi, Sorry for top posting... I have just realized colleague of mine is doing some work in the ISO 9660 code including part which we are discussing here. I asked her to post the patches on the grub-devel. You can expect them soon. Please take a look at them and comment/review. Daniel On Tue, Nov

Re: Possible memory fault in fs/iso9660 (correction)

2022-11-29 Thread Thomas Schmitt
Hi, i wrote: > > > I will think about creating such an ISO by help of xorriso and dd. Daniel Kiper wrote: > Yeah, that would be perfect... I believe to have created one. But grub-fstest does not produce a memory fault. See my mail Date: Tue, 29 Nov 2022 19:47:22 +0100 Message-Id: <5036388200

Re: Possible memory fault in fs/iso9660 (correction)

2022-11-29 Thread Thomas Schmitt
Hi, Fengtao wrote: > I think: > (char *) entry < (char *) sua + sua_size - 3 && entry->len > 0 > is ok, or: > (char *) entry <= (char *) sua + sua_size - 4 && entry->len > 0 "4" would be overdone. There are SUSP and RRIP entries of length 4, which would be ignored if appearing at

Re: Possible memory fault in fs/iso9660 (correction)

2022-11-29 Thread Daniel Kiper
On Tue, Nov 29, 2022 at 05:32:56PM +0800, Fengtao (fengtao, Euler) via Grub-devel wrote: > Hi, Thomas > Sorry for the delay, I am also not familiar with ISO format. > But, i have check the cdrkit src-code[1] and syslinux src-code[2] > > I think: > (char *) entry < (char *) sua + sua_size - 3

Re: Possible memory fault in fs/iso9660 (correction)

2022-11-29 Thread Fengtao (fengtao, Euler) via Grub-devel
Hi, Thomas Sorry for the delay, I am also not familiar with ISO format. But, i have check the cdrkit src-code[1] and syslinux src-code[2] I think: (char *) entry < (char *) sua + sua_size - 3 && entry->len > 0 is ok, or: (char *) entry <= (char *) sua + sua_size - 4 && entry->len >

Re: Possible memory fault in fs/iso9660 (correction)

2022-11-24 Thread Thomas Schmitt
Hi, (Again i Cc t.feng in the hope that the review is not finished yet. :)) Daniel Kiper wrote: > I am not an ISO format expert but your thinking LGTM. So you agree that "3" is really the right number if any remaining bytes fewer than 4 shall be ignored ? (I don't trust myself, although i made a

Re: Possible memory fault in fs/iso9660 (correction)

2022-11-24 Thread Daniel Kiper
On Sat, Nov 19, 2022 at 01:57:59PM +0100, Thomas Schmitt wrote: > Hi, > > i wrote: > > I think the loop end condition should use 4 rather than 1: > > (char *) entry < (char *) sua + sua_size - 4 && entry->len > 0 > > Urm ... better "3 rather than 1": > >(char *) entry < (char *) sua +

Re: Possible memory fault in fs/iso9660 (correction)

2022-11-19 Thread Thomas Schmitt
Hi, i wrote: > I think the loop end condition should use 4 rather than 1: > (char *) entry < (char *) sua + sua_size - 4 && entry->len > 0 Urm ... better "3 rather than 1": (char *) entry < (char *) sua + sua_size - 3 && entry->len > 0 The memory fault by entry->len will appear if

Possible memory fault in fs/iso9660

2022-11-19 Thread Thomas Schmitt
Hi, (Cc-ing t.feng in the hope that this issue can become part of the code review.) While reviewing "[PATCH 7/9]" by t.feng, i wonder whether there is a bug in grub_iso9660_susp_iterate() in regard to the end of the SUSP data: for (entry = (struct grub_iso9660_susp_entry *) sua; (char *) entry