Changeset 131 for trunk/lib

Timestamp:

01/11/09 15:14:20 (16 years ago)

Author:

tim

Message:

fixed an hbin length validation related to vk records
added hbin length validation for class names and data cells

File:

• trunk/lib/regfi.c (modified) (10 diffs)

trunk/lib/regfi.c

@@ -796 +796 @@
     
     vk_offset =  voffsets[i] + REGF_BLOCKSIZE;
-    vk_max_length = hbin->block_size - vk_offset + sizeof(uint32);
+    vk_max_length = hbin->block_size + hbin->file_off - vk_offset;
     ret_val[i] = regfi_parse_vk(file, vk_offset, vk_max_length, strict);
     if(ret_val[i] == NULL)
@@ -1604 +1604 @@
 {
   uint8 nk_header[REGFI_NK_MIN_LENGTH];
+  REGF_HBIN *hbin;
   REGF_NK_REC* ret_val;
-  uint32 length;
-  uint32 cell_length;
+  uint32 length,cell_length;
+  uint32 class_offset, class_maxsize;
   bool unalloc = false;
 
@@ -1722 +1723 @@
   if(ret_val->classname_off != REGF_OFFSET_NONE)
   {
-    ret_val->classname 
-      = regfi_parse_classname(file, ret_val->classname_off+REGF_BLOCKSIZE,
-                              &ret_val->classname_length, strict);
+    hbin = regfi_lookup_hbin(file, ret_val->classname_off);
+    if(hbin)
+    {
+      class_offset = ret_val->classname_off+REGF_BLOCKSIZE;
+      class_maxsize = hbin->block_size + hbin->file_off - class_offset;
+      ret_val->classname
+        = regfi_parse_classname(file, class_offset, &ret_val->classname_length, 
+                                class_maxsize, strict);
+    }
+    else
+      ret_val->classname = NULL;
     /*
     if(strict && ret_val->classname == NULL)
@@ -1735 +1744 @@
 
 
-/*******************************************************************/
-/* XXX: Not currently validating against hbin length.              */
-/*******************************************************************/
 char* regfi_parse_classname(REGF_FILE* file, uint32 offset, 
-                            uint16* name_length, bool strict)
+                            uint16* name_length, uint32 max_size, bool strict)
 {
   char* ret_val = NULL;
@@ -1748 +1754 @@
   if(*name_length > 0 && offset != REGF_OFFSET_NONE 
      && offset == (offset & 0xFFFFFFF8))
-  {    
+  {
     if(!regfi_parse_cell(file->fd, offset, NULL, 0, &cell_length, &unalloc))
         return NULL;
 
-    if(cell_length < *name_length)
+    if((cell_length & 0xFFFFFFF8) != cell_length)
+      return NULL;
+    
+    if(cell_length > max_size)
     {
       if(strict)
         return NULL;
-      *name_length = cell_length & 0xFFFFFFF8;
+      cell_length = max_size;
+    }
+
+    if((cell_length - 4) < *name_length)
+    {
+      if(strict)
+        return NULL;
+      *name_length = cell_length - 4;
     }
     
@@ -1784 +1800 @@
 {
   REGF_VK_REC* ret_val;
+  REGF_HBIN *hbin;
   uint8 vk_header[REGFI_VK_MIN_LENGTH];
   uint32 raw_data_size, length, cell_length;
+  uint32 data_offset, data_maxsize;
   bool unalloc = false;
 
@@ -1878 +1896 @@
   else
   {
-    ret_val->data = regfi_parse_data(file, ret_val->data_off+REGF_BLOCKSIZE,
-                                     raw_data_size, strict);
+    hbin = regfi_lookup_hbin(file, ret_val->data_off);
+    if(hbin)
+    {
+      data_offset = ret_val->data_off+REGF_BLOCKSIZE;
+      data_maxsize = hbin->block_size + hbin->file_off - data_offset;
+      ret_val->data = regfi_parse_data(file, data_offset, raw_data_size,
+                                       data_maxsize, strict);
+    }
+    else
+      ret_val->data = NULL;
+
     if(strict && (ret_val->data == NULL))
     {
@@ -1892 +1919 @@
 
 
-uint8* regfi_parse_data(REGF_FILE* file, uint32 offset, uint32 length, bool strict)
+uint8* regfi_parse_data(REGF_FILE* file, uint32 offset, uint32 length,
+                        uint32 max_size, bool strict)
 {
   uint8* ret_val;
@@ -1921 +1949 @@
     if((cell_length & 0xFFFFFFF8) != cell_length)
       return NULL;
+
+    if(cell_length > max_size)
+    {
+      if(strict)
+        return NULL;
+      else
+        cell_length = max_size;
+    }
 
     if(cell_length - 4 < length)
@@ -1933 +1969 @@
         length = cell_length - 4;
     }
-
-    /* XXX: There is currently no check to ensure the data 
-     *      cell doesn't cross HBIN boundary.
-     */
 
     if((ret_val = (uint8*)zalloc(sizeof(uint8)*length)) == NULL)