Skip to content

Commit 9b7a63e

Browse files
fdesbiensfdesbiens
authored
Merge commit from fork
fix (host/storage): prevent stack overflow from infinite partition recursion
2 parents 95b554a + d562e7a commit 9b7a63e

21 files changed

Lines changed: 115 additions & 31 deletions

File tree

‎common/usbx_host_classes/inc/ux_host_class_storage.h‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -486,6 +486,8 @@ typedef struct UX_HOST_CLASS_STORAGE_STRUCT
486486
UINT ux_host_class_storage_lun_types[UX_MAX_HOST_LUN];
487487
#if defined(UX_HOST_CLASS_STORAGE_NO_FILEX)
488488
ULONG ux_host_class_storage_last_sector_number;
489+
#else
490+
ULONG ux_host_class_storage_mounted_partitions_count;
489491
#endif
490492
ULONG ux_host_class_storage_sector_size;
491493
ULONG ux_host_class_storage_data_phase_length;

‎common/usbx_host_classes/src/ux_host_class_storage_device_initialize.c‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -166,6 +166,12 @@ UINT inst_index;
166166
case UX_HOST_CLASS_STORAGE_MEDIA_IOMEGA_CLICK:
167167

168168
#if !defined(UX_HOST_CLASS_STORAGE_NO_FILEX)
169+
/* the ux_host_class_storage_mounted_partitions_count is needed to avoid
170+
infinite recursive loops when mounting extended partions.
171+
The value is checked against the UX_HOST_CLASS_STORAGE_MAX_PARTITIONS_COUNT
172+
*/
173+
storage -> ux_host_class_storage_mounted_partitions_count = 0;
174+
169175
/* Try to read the device media in search for a partition table or boot sector.
170176
We are at the root of the disk, so use sector 0 as the starting point. */
171177
_ux_host_class_storage_media_mount(storage, 0);

‎common/usbx_host_classes/src/ux_host_class_storage_partition_read.c‎

Lines changed: 35 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,6 @@
2727
#include "ux_api.h"
2828
#include "ux_host_class_storage.h"
2929
#include "ux_host_stack.h"
30-
31-
3230
/**************************************************************************/
3331
/* */
3432
/* FUNCTION RELEASE */
@@ -90,49 +88,55 @@ UINT _ux_host_class_storage_partition_read(UX_HOST_CLASS_STORAGE *storage, UCHA
9088
UINT status = UX_ERROR;
9189
UINT partition_index;
9290

91+
/* Check recursion/mount count before processing. */
92+
if (storage -> ux_host_class_storage_mounted_partitions_count > UX_HOST_CLASS_STORAGE_MAX_PARTITIONS_COUNT)
93+
{
94+
return UX_HOST_CLASS_STORAGE_ERROR_MEDIA_NOT_READ;
95+
}
9396

9497
/* Point the sector buffer to the first partition entry. */
9598
sector_memory += UX_HOST_CLASS_STORAGE_PARTITION_TABLE_START;
96-
99+
97100
/* There are 4 partitions in a partition table. */
98101
for (partition_index = 0; partition_index < 4; partition_index++)
99102
{
103+
/* Increment the mounted partition count for every entry processed. */
104+
storage -> ux_host_class_storage_mounted_partitions_count++;
105+
106+
/* Check again after incrementing. */
107+
if (storage -> ux_host_class_storage_mounted_partitions_count > UX_HOST_CLASS_STORAGE_MAX_PARTITIONS_COUNT)
108+
{
109+
/* Too many partition entries processed, abort to prevent stack overflow. */
110+
return UX_HOST_CLASS_STORAGE_ERROR_MEDIA_NOT_READ;
111+
}
100112

101113
/* Check if we recognize this partition entry. */
102114
switch(*(sector_memory + UX_HOST_CLASS_STORAGE_PARTITION_TYPE))
103115
{
104-
105-
case UX_HOST_CLASS_STORAGE_PARTITION_FAT_12:
106-
case UX_HOST_CLASS_STORAGE_PARTITION_FAT_16:
107-
case UX_HOST_CLASS_STORAGE_PARTITION_FAT_16L:
108-
case UX_HOST_CLASS_STORAGE_PARTITION_FAT_16_LBA_MAPPED:
109-
case UX_HOST_CLASS_STORAGE_PARTITION_FAT_32_1:
110-
case UX_HOST_CLASS_STORAGE_PARTITION_FAT_32_2:
111-
case UX_HOST_CLASS_STORAGE_PARTITION_EXFAT:
112-
113-
/* We have found a legal partition entry pointing to a potential boot sector. */
114-
status = _ux_host_class_storage_media_open(storage, sector + _ux_utility_long_get(sector_memory + UX_HOST_CLASS_STORAGE_PARTITION_SECTORS_BEFORE));
115-
break;
116-
117-
case UX_HOST_CLASS_STORAGE_PARTITION_EXTENDED:
118-
case UX_HOST_CLASS_STORAGE_PARTITION_EXTENDED_LBA_MAPPED:
119-
120-
/* We have found an entry to an extended partition. We need to read that partition sector
121-
and recursively mount all partitions found. */
122-
status = _ux_host_class_storage_media_mount(storage, sector + _ux_utility_long_get(sector_memory + UX_HOST_CLASS_STORAGE_PARTITION_SECTORS_BEFORE));
123-
break;
124-
125-
default:
126-
127-
/* We have found something which is not a DOS recognized partition, or an empty entry.
128-
Ignore it and proceed with the rest. */
129-
break;
116+
case UX_HOST_CLASS_STORAGE_PARTITION_FAT_12:
117+
case UX_HOST_CLASS_STORAGE_PARTITION_FAT_16:
118+
case UX_HOST_CLASS_STORAGE_PARTITION_FAT_16L:
119+
case UX_HOST_CLASS_STORAGE_PARTITION_FAT_16_LBA_MAPPED:
120+
case UX_HOST_CLASS_STORAGE_PARTITION_FAT_32_1:
121+
case UX_HOST_CLASS_STORAGE_PARTITION_FAT_32_2:
122+
case UX_HOST_CLASS_STORAGE_PARTITION_EXFAT:
123+
/* We have found a legal partition entry pointing to a potential boot sector. */
124+
status = _ux_host_class_storage_media_open(storage, sector + _ux_utility_long_get(sector_memory + UX_HOST_CLASS_STORAGE_PARTITION_SECTORS_BEFORE));
125+
break;
126+
case UX_HOST_CLASS_STORAGE_PARTITION_EXTENDED:
127+
case UX_HOST_CLASS_STORAGE_PARTITION_EXTENDED_LBA_MAPPED:
128+
/* We have found an entry to an extended partition. We need to read that partition sector
129+
and recursively mount all partitions found. */
130+
status = _ux_host_class_storage_media_mount(storage, sector + _ux_utility_long_get(sector_memory + UX_HOST_CLASS_STORAGE_PARTITION_SECTORS_BEFORE));
131+
break;
132+
default:
133+
/* We have found something which is not a DOS recognized partition, or an empty entry.
134+
Ignore it and proceed with the rest. */
135+
break;
130136
}
131-
132137
/* Move to the next partition entry. */
133138
sector_memory += UX_HOST_CLASS_STORAGE_PARTITION_TABLE_SIZE;
134139
}
135-
136140
/* Return completion status. */
137141
return(status);
138142
#endif

‎ports/arm9/iar/inc/ux_port.h‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -204,6 +204,10 @@ typedef LONG SLONG;
204204
#define UX_HOST_CLASS_STORAGE_MAX_MEDIA 2
205205
#endif
206206

207+
#ifndef UX_HOST_CLASS_STORAGE_MAX_PARTITIONS_COUNT
208+
#define UX_HOST_CLASS_STORAGE_MAX_PARTITIONS_COUNT 8
209+
#endif
210+
207211
#ifndef UX_SLAVE_REQUEST_CONTROL_MAX_LENGTH
208212
#define UX_SLAVE_REQUEST_CONTROL_MAX_LENGTH 256
209213
#endif

‎ports/cortex_a5/gnu/inc/ux_port.h‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -204,6 +204,10 @@ typedef LONG SLONG;
204204
#define UX_HOST_CLASS_STORAGE_MAX_MEDIA 2
205205
#endif
206206

207+
#ifndef UX_HOST_CLASS_STORAGE_MAX_PARTITIONS_COUNT
208+
#define UX_HOST_CLASS_STORAGE_MAX_PARTITIONS_COUNT 8
209+
#endif
210+
207211
#ifndef UX_SLAVE_REQUEST_CONTROL_MAX_LENGTH
208212
#define UX_SLAVE_REQUEST_CONTROL_MAX_LENGTH 256
209213
#endif

‎ports/cortex_a5/iar/inc/ux_port.h‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -204,6 +204,10 @@ typedef LONG SLONG;
204204
#define UX_HOST_CLASS_STORAGE_MAX_MEDIA 2
205205
#endif
206206

207+
#ifndef UX_HOST_CLASS_STORAGE_MAX_PARTITIONS_COUNT
208+
#define UX_HOST_CLASS_STORAGE_MAX_PARTITIONS_COUNT 8
209+
#endif
210+
207211
#ifndef UX_SLAVE_REQUEST_CONTROL_MAX_LENGTH
208212
#define UX_SLAVE_REQUEST_CONTROL_MAX_LENGTH 256
209213
#endif

‎ports/cortex_a7/gnu/inc/ux_port.h‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -204,6 +204,10 @@ typedef LONG SLONG;
204204
#define UX_HOST_CLASS_STORAGE_MAX_MEDIA 2
205205
#endif
206206

207+
#ifndef UX_HOST_CLASS_STORAGE_MAX_PARTITIONS_COUNT
208+
#define UX_HOST_CLASS_STORAGE_MAX_PARTITIONS_COUNT 8
209+
#endif
210+
207211
#ifndef UX_SLAVE_REQUEST_CONTROL_MAX_LENGTH
208212
#define UX_SLAVE_REQUEST_CONTROL_MAX_LENGTH 256
209213
#endif

‎ports/cortex_a7/iar/inc/ux_port.h‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -204,6 +204,10 @@ typedef LONG SLONG;
204204
#define UX_HOST_CLASS_STORAGE_MAX_MEDIA 2
205205
#endif
206206

207+
#ifndef UX_HOST_CLASS_STORAGE_MAX_PARTITIONS_COUNT
208+
#define UX_HOST_CLASS_STORAGE_MAX_PARTITIONS_COUNT 8
209+
#endif
210+
207211
#ifndef UX_SLAVE_REQUEST_CONTROL_MAX_LENGTH
208212
#define UX_SLAVE_REQUEST_CONTROL_MAX_LENGTH 256
209213
#endif

‎ports/cortex_a8/gnu/inc/ux_port.h‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -204,6 +204,10 @@ typedef LONG SLONG;
204204
#define UX_HOST_CLASS_STORAGE_MAX_MEDIA 2
205205
#endif
206206

207+
#ifndef UX_HOST_CLASS_STORAGE_MAX_PARTITIONS_COUNT
208+
#define UX_HOST_CLASS_STORAGE_MAX_PARTITIONS_COUNT 8
209+
#endif
210+
207211
#ifndef UX_SLAVE_REQUEST_CONTROL_MAX_LENGTH
208212
#define UX_SLAVE_REQUEST_CONTROL_MAX_LENGTH 256
209213
#endif

‎ports/cortex_a8/iar/inc/ux_port.h‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -204,6 +204,10 @@ typedef LONG SLONG;
204204
#define UX_HOST_CLASS_STORAGE_MAX_MEDIA 2
205205
#endif
206206

207+
#ifndef UX_HOST_CLASS_STORAGE_MAX_PARTITIONS_COUNT
208+
#define UX_HOST_CLASS_STORAGE_MAX_PARTITIONS_COUNT 8
209+
#endif
210+
207211
#ifndef UX_SLAVE_REQUEST_CONTROL_MAX_LENGTH
208212
#define UX_SLAVE_REQUEST_CONTROL_MAX_LENGTH 256
209213
#endif

0 commit comments

Comments
 (0)