[RHEL5 PATCH 1/3][v3] udf: Avoid run away loop when partition table length is corrupted
by Nikola Pajkovsky
https://bugzilla.redhat.com/show_bug.cgi?id=843141
link: http://post-office.corp.redhat.com/archives/rhkernel-list/2012-October/ms...
commit adee11b2085bee90bd8f4f52123ffb07882d6256
Author: Jan Kara <jack(a)suse.cz>
Date: Wed Jun 27 20:20:22 2012 +0200
udf: Avoid run away loop when partition table length is corrupted
Check provided length of partition table so that (possibly maliciously)
corrupted partition table cannot cause accessing data beyond current buffer.
Signed-off-by: Jan Kara <jack(a)suse.cz>
Signed-off-by: Nikola Pajkovsky <npajkovs(a)redhat.com>
---
fs/udf/super.c | 30 +++++++++++++++++++++---------
1 file changed, 21 insertions(+), 9 deletions(-)
diff --git a/fs/udf/super.c b/fs/udf/super.c
index 6f84480..f4a1800 100644
--- a/fs/udf/super.c
+++ b/fs/udf/super.c
@@ -1032,13 +1032,22 @@ udf_load_logicalvol(struct super_block *sb, struct buffer_head * bh, kernel_lb_a
struct logicalVolDesc *lvd;
int i, j, offset;
uint8_t type;
-
+ unsigned table_len;
lvd = (struct logicalVolDesc *)bh->b_data;
+ table_len = le32_to_cpu(lvd->mapTableLength);
+ if (sizeof(*lvd) + table_len > sb->s_blocksize) {
+ udf_error(sb, __FUNCTION__,
+ "error loading logical volume descriptor: "
+ "Partition table too long (%u > %lu)\n", table_len,
+ sb->s_blocksize - sizeof(*lvd));
+ return 1;
+ }
+
UDF_SB_ALLOC_PARTMAPS(sb, le32_to_cpu(lvd->numPartitionMaps));
for (i=0,offset=0;
- i<UDF_SB_NUMPARTS(sb) && offset<le32_to_cpu(lvd->mapTableLength);
+ i<UDF_SB_NUMPARTS(sb) && offset<table_len;
i++,offset+=((struct genericPartitionMap *)&(lvd->partitionMaps[offset]))->partitionMapLength)
{
type = ((struct genericPartitionMap *)&(lvd->partitionMaps[offset]))->partitionMapType;
@@ -1258,8 +1267,12 @@ udf_process_sequence(struct super_block *sb, long block, long lastblock, kernel_
if (i == VDS_POS_PRIMARY_VOL_DESC)
udf_load_pvoldesc(sb, bh);
- else if (i == VDS_POS_LOGICAL_VOL_DESC)
- udf_load_logicalvol(sb, bh, fileset);
+ else if (i == VDS_POS_LOGICAL_VOL_DESC) {
+ if (udf_load_logicalvol(sb, bh, fileset)) {
+ brelse(bh);
+ return 1;
+ }
+ }
else if (i == VDS_POS_PARTITION_DESC)
{
struct buffer_head *bh2 = NULL;
@@ -1338,13 +1351,12 @@ udf_load_partition(struct super_block *sb, kernel_lb_addr *fileset)
brelse(bh);
- /* Process the main & reserve sequences */
+ /* Process the main sequence */
/* responsible for finding the PartitionDesc(s) */
- if (!(udf_process_sequence(sb, main_s, main_e, fileset) &&
- udf_process_sequence(sb, reserve_s, reserve_e, fileset)))
- {
+ if (udf_process_sequence(sb, main_s, main_e, fileset))
+ return 1;
+ else
break;
- }
}
}
--
1.8.0.2
11 years, 4 months
[RHEL5 PATCH 2/3][v3] udf: Improve table length check to avoid possible overflow
by Nikola Pajkovsky
https://bugzilla.redhat.com/show_bug.cgi?id=843141
commit 57b9655d01ef057a523e810d29c37ac09b80eead
Author: Jan Kara <jack(a)suse.cz>
Date: Tue Jul 10 17:58:04 2012 +0200
udf: Improve table length check to avoid possible overflow
When a partition table length is corrupted to be close to 1 << 32, the
check for its length may overflow on 32-bit systems and we will think
the length is valid. Later on the kernel can crash trying to read beyond
end of buffer. Fix the check to avoid possible overflow.
CC: stable(a)vger.kernel.org
Reported-by: Ben Hutchings <ben(a)decadent.org.uk>
Signed-off-by: Jan Kara <jack(a)suse.cz>
Signed-off-by: Nikola Pajkovsky <npajkovs(a)redhat.com>
---
fs/udf/super.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/udf/super.c b/fs/udf/super.c
index f4a1800..77d83fe 100644
--- a/fs/udf/super.c
+++ b/fs/udf/super.c
@@ -1036,7 +1036,7 @@ udf_load_logicalvol(struct super_block *sb, struct buffer_head * bh, kernel_lb_a
lvd = (struct logicalVolDesc *)bh->b_data;
table_len = le32_to_cpu(lvd->mapTableLength);
- if (sizeof(*lvd) + table_len > sb->s_blocksize) {
+ if (table_len > sb->s_blocksize - sizeof(*lvd)) {
udf_error(sb, __FUNCTION__,
"error loading logical volume descriptor: "
"Partition table too long (%u > %lu)\n", table_len,
--
1.8.0.2
11 years, 4 months
Building ABRT on openSUSE 12.2
by Michal Toman
Hi,
I've prepared patches for ABRT & libreport so that they build on
openSUSE 12.2. There are many ugly hacks just to make it build ;)
== btparser ==
* master builds without problems
== libreport ==
* clone latest git & apply the attached patch
* install dependencies: dbus-devel = dbus-1-devel; nss-devel =
mozilla-nss-devel; json-c-devel = libjson-devel;
* for some reason libtar-devel is in "Education" repository, you need to
enable it in YaST
* ./autogen.sh && ./configure --without-bugzilla && make rpm
* this builds everything except bugzilla. libreport-anaconda and
libreport-compat are built, but they depend on libreport-bugzilla.
== ABRT ==
* clone latest git & apply the attached patch
* install dependencies: especially dbus-1-glib-devel
* ./autogen.sh && ./configure && make rpm
* this builds everything except bodhi (bodhi links to libreport-web,
which is not built because of missing bugzilla). abrt-cli and
abrt-desktop are built, but also depend on bugzilla
* disable gpgcheck in /etc/abrt/abrt-action-save-package-data.conf
* start services ("service abrt{d,-ccpp,-oops,-xorg} start" works :)
* voila
This is just a proof of concept, I'm not familiar enough with autotools
to do everything correctly.
Michal
11 years, 4 months
[Automatic Bug Reporting Tool - ABRT] #916: remove 'Start Autoreporting' button
by fedora-badges
#916: remove 'Start Autoreporting' button
--------------------+----------------------------
Reporter: jfilak | Owner: jfilak
Type: task | Status: new
Priority: major | Milestone: Autoreporting
Component: applet | Version:
Keywords: | Blocked By:
Blocking: |
--------------------+----------------------------
Don't show the 'Start Autoreporting' button in notification bubble. Use a
dialogue which is shown after user clicked on 'Report' button. The
dialogue will be shown only if autoreporting is not enabled or user
doesn't wishes to be bothered by that.
Dialogue:
Do you want to enable automatic reporting of problems?
* Yes
* No
* No and don't ask me again
- 'Yes' enables autoreporing and the dialogue won't be shown until user
disable autoreporting.
--
Ticket URL: <https://fedorahosted.org/abrt/ticket/916>
Automatic Bug Reporting Tool - ABRT <http://fedorahoted.org/abrt/>
Automatic bug reporting tool
11 years, 4 months
[LIBREPORT PATCH 1/2] refactor: move ask_yes_no_save_result from wizard to libreport-gtk
by Jakub Filak
- related to trac#916
Signed-off-by: Jakub Filak <jfilak(a)redhat.com>
---
po/POTFILES.in | 1 +
src/gtk-helpers/Makefile.am | 3 +-
src/gtk-helpers/ask_dialogs.c | 81 ++++++++++++++++++++++++++++++++
src/gtk-helpers/internal_libreport_gtk.h | 20 ++++++++
src/gui-wizard-gtk/wizard.c | 66 ++------------------------
5 files changed, 107 insertions(+), 64 deletions(-)
create mode 100644 src/gtk-helpers/ask_dialogs.c
diff --git a/po/POTFILES.in b/po/POTFILES.in
index b310941..870856c 100644
--- a/po/POTFILES.in
+++ b/po/POTFILES.in
@@ -5,6 +5,7 @@ src/cli/cli.c
src/cli/cli-report.c
src/client-python/debuginfo.py
src/client-python/__init__.py
+src/gtk-helpers/ask_dialogs.c
src/gtk-helpers/config_dialog.c
src/gtk-helpers/event_config_dialog.c
src/gtk-helpers/secrets.c
diff --git a/src/gtk-helpers/Makefile.am b/src/gtk-helpers/Makefile.am
index 0d3f9d8..b67186f 100644
--- a/src/gtk-helpers/Makefile.am
+++ b/src/gtk-helpers/Makefile.am
@@ -14,7 +14,8 @@ libreport_gtk_la_SOURCES = \
hyperlinks.c \
autowrapped_label.c \
workflow_config_dialog.c \
- config_dialog.c
+ config_dialog.c \
+ ask_dialogs.c
libreport_gtk_la_CPPFLAGS = \
-I$(srcdir)/../include \
diff --git a/src/gtk-helpers/ask_dialogs.c b/src/gtk-helpers/ask_dialogs.c
new file mode 100644
index 0000000..7994e1b
--- /dev/null
+++ b/src/gtk-helpers/ask_dialogs.c
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2012 ABRT Team
+ * Copyright (C) 2012 RedHat inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+#include <internal_libreport_gtk.h>
+
+static void save_dialog_response(GtkDialog *dialog, gint response_id, gpointer user_data)
+{
+ *(gint*)user_data = response_id;
+}
+
+/*
+ * We don't allow users to remember 'No' answer therefore if 'Don't ask me again' box is
+ * checked we have to disable 'No' button
+ */
+static void on_toggle_ask_yes_no_yesforever_cb(GtkToggleButton *tb, gpointer user_data)
+{
+ gtk_widget_set_sensitive(GTK_WIDGET(user_data), !gtk_toggle_button_get_active(tb));
+}
+
+/*
+ * Function shows a dialog with 'Yes/No' buttons and a check box allowing to
+ * remember the answer. The "Don't ask me again" response is stored in
+ * configuration file under 'key'.
+ */
+int run_ask_yes_no_yesforever_dialog(const char *key, const char *message, GtkWindow *parent)
+{
+ const char *ask_result = get_user_setting(key);
+
+ if (ask_result && string_to_bool(ask_result) == false)
+ /* Do you want to be asked? -> No, I don't. Do whatever you want */
+ return true;
+
+ GtkWidget *dialog = gtk_message_dialog_new(parent,
+ GTK_DIALOG_DESTROY_WITH_PARENT,
+ GTK_MESSAGE_QUESTION,
+ GTK_BUTTONS_NONE,
+ "%s", message);
+
+ gtk_dialog_add_button(GTK_DIALOG(dialog), GTK_STOCK_YES, GTK_RESPONSE_YES);
+ GtkWidget *no_button = gtk_dialog_add_button(GTK_DIALOG(dialog), GTK_STOCK_NO, GTK_RESPONSE_NO);
+
+ gint response = GTK_RESPONSE_NO;
+ g_signal_connect(G_OBJECT(dialog), "response",
+ G_CALLBACK(save_dialog_response), &response);
+
+ GtkWidget *ask_yes_no_cb = gtk_check_button_new_with_label(_("Don't ask me again"));
+ gtk_box_pack_start(GTK_BOX(gtk_dialog_get_content_area(GTK_DIALOG(dialog))),
+ ask_yes_no_cb, TRUE, TRUE, 0);
+ g_signal_connect(ask_yes_no_cb, "toggled",
+ G_CALLBACK(on_toggle_ask_yes_no_yesforever_cb), (gpointer)no_button);
+
+ /* Don't check the box by default. If the box is checked the 'No' button is disabled and
+ * we don't want to force users to click on 'Yes' button. */
+
+ gtk_widget_show(ask_yes_no_cb);
+ gtk_dialog_run(GTK_DIALOG(dialog));
+
+ /* the box is checked -> Don't ask me again and my response is always 'Yes' */
+ set_user_setting(key, gtk_toggle_button_get_active(GTK_TOGGLE_BUTTON(ask_yes_no_cb)) ? "no" : "yes");
+
+ gtk_widget_destroy(dialog);
+
+ return response == GTK_RESPONSE_YES;
+}
+
diff --git a/src/gtk-helpers/internal_libreport_gtk.h b/src/gtk-helpers/internal_libreport_gtk.h
index c59158e..cecad6f 100644
--- a/src/gtk-helpers/internal_libreport_gtk.h
+++ b/src/gtk-helpers/internal_libreport_gtk.h
@@ -95,6 +95,26 @@ struct url_token
#define find_url_tokens libreport_find_url_tokens
GList *find_url_tokens(const char *line);
+/* Ask dialogs */
+
+/*
+ * Runs a dialog with 'Yes'/'No' buttons and 'Don't ask me again' check box and
+ * waits until the dialog is closed. This variant of dialog allows user to
+ * click only 'Yes' button if the check box is checked and stores "no" string
+ * in user settings if the check box is checked.
+ *
+ * Uses libreport's user settings. Don't forget to call load_user_settings()
+ * before the first call of this funcion and call save_user_settings() after
+ * the last call of this function.
+ *
+ * @param key Key under which the response is stored. Not NULL
+ * @param message Displayed message. Not NULL
+ * @param parent Transient parent or NULL
+ * @returns Non 0 if the answer is "Yes"; otherwise 0
+ */
+#define run_ask_yes_no_yesforever_dialog libreport_run_ask_yes_no_yesforever_dialog
+int run_ask_yes_no_yesforever_dialog(const char *key, const char *message, GtkWindow *parent);
+
#ifdef __cplusplus
}
#endif
diff --git a/src/gui-wizard-gtk/wizard.c b/src/gui-wizard-gtk/wizard.c
index 8774653..781fd57 100644
--- a/src/gui-wizard-gtk/wizard.c
+++ b/src/gui-wizard-gtk/wizard.c
@@ -247,11 +247,6 @@ static void remove_child_widget(GtkWidget *widget, gpointer unused)
gtk_widget_destroy(widget);
}
-static void save_dialog_response(GtkDialog *dialog, gint response_id, gpointer user_data)
-{
- *(gint*)user_data = response_id;
-}
-
static void on_configure_event_cb(GtkWidget *button, gpointer user_data)
{
char *event_name = (char *)user_data;
@@ -321,67 +316,12 @@ static void update_window_title(void)
free(title);
}
-/*
- * We don't allow users to remember 'No' answer therefore if 'Don't ask me again' box is
- * checked we have to disable 'No' button
- */
-static void on_toggle_ask_yes_no_save_result_cb(GtkToggleButton *tb, gpointer user_data)
-{
- gtk_widget_set_sensitive(GTK_WIDGET(user_data), !gtk_toggle_button_get_active(tb));
-}
-
-/*
- * Function shows a dialog with 'Yes/No' buttons and a check box allowing to
- * remember the answer. The answer is stored in configuration file under
- * 'option_name' key.
- */
-static bool ask_yes_no_save_result(const char *message, const char *option_name)
-{
- const char *ask_result = get_user_setting(option_name);
-
- if (ask_result && string_to_bool(ask_result) == false)
- /* Do you want to be asked? -> No, I don't. Do whatever you want */
- return true;
-
- GtkWidget *dialog = gtk_message_dialog_new(GTK_WINDOW(g_wnd_assistant),
- GTK_DIALOG_DESTROY_WITH_PARENT,
- GTK_MESSAGE_QUESTION,
- GTK_BUTTONS_NONE,
- "%s", message);
-
- gtk_dialog_add_button(GTK_DIALOG(dialog), GTK_STOCK_YES, GTK_RESPONSE_YES);
- GtkWidget *no_button = gtk_dialog_add_button(GTK_DIALOG(dialog), GTK_STOCK_NO, GTK_RESPONSE_NO);
-
- gint response = GTK_RESPONSE_NO;
- g_signal_connect(G_OBJECT(dialog), "response",
- G_CALLBACK(save_dialog_response), &response);
-
- GtkWidget *ask_yes_no_cb = gtk_check_button_new_with_label(_("Don't ask me again"));
- gtk_box_pack_start(GTK_BOX(gtk_dialog_get_content_area(GTK_DIALOG(dialog))),
- ask_yes_no_cb, TRUE, TRUE, 0);
- g_signal_connect(ask_yes_no_cb, "toggled",
- G_CALLBACK(on_toggle_ask_yes_no_save_result_cb), (gpointer)no_button);
-
- /* Don't check the box by default. If the box is checked the 'No' button is disabled and
- * we don't want to force users to click on 'Yes' button. */
-
- gtk_widget_show(ask_yes_no_cb);
- gtk_dialog_run(GTK_DIALOG(dialog));
-
- /* the box is checked -> Don't ask me again and my response is always 'Yes' */
- set_user_setting(option_name, gtk_toggle_button_get_active(GTK_TOGGLE_BUTTON(ask_yes_no_cb)) ? "no" : "yes");
-
- gtk_widget_destroy(dialog);
-
- return response == GTK_RESPONSE_YES;
-}
-
static bool ask_continue_before_steal(const char *base_dir, const char *dump_dir)
{
char *msg = xasprintf(_("Need writable directory, but '%s' is not writable."
" Move it to '%s' and operate on the moved data?"),
dump_dir, base_dir);
- const bool response = ask_yes_no_save_result(msg, "ask_steal_dir");
+ const bool response = run_ask_yes_no_yesforever_dialog("ask_steal_dir", msg, GTK_WINDOW(g_wnd_assistant));
free(msg);
return response;
}
@@ -1674,7 +1614,7 @@ static int run_event_gtk_ask_yes_no(const char *msg, void *args)
static int run_event_gtk_ask_yes_no_yesforever(const char *key, const char *msg, void *args)
{
- const int ret = ask_yes_no_save_result(msg, key);
+ const int ret = run_ask_yes_no_yesforever_dialog(key, msg, GTK_WINDOW(g_wnd_assistant));
log_request_response_communication(msg, ret ? "YES" : "NO", (struct analyze_event_data *)args);
return ret;
}
@@ -2518,7 +2458,7 @@ static bool get_sensitive_data_permission(const char *event_name)
char *msg = xasprintf(_("Event '%s' requires permission to send possibly sensitive data."
"\nDo you want to continue?"),
ec_get_screen_name(event_cfg) ? ec_get_screen_name(event_cfg) : event_name);
- const bool response = ask_yes_no_save_result(msg, "ask_send_sensitive_data");
+ const bool response = run_ask_yes_no_yesforever_dialog("ask_send_sensitive_data", msg, GTK_WINDOW(g_wnd_assistant));
free(msg);
return response;
--
1.7.11.7
11 years, 4 months