[PATCH 0/2] hfs, hfsplus: bound the partition-table and wrapper hops

[Matthias Goergens]

hfs_mdb_get() and hfsplus_read_wrapper() follow a partition table, and
hfsplus also an HFS wrapper, back to the volume header with no bound on
how often.  A partition entry or wrapper descriptor with a zero offset
sends the loop back to the header it has just read, and a crafted image
hangs the mount.

These patches allow each kind of hop at most once: one partition-table
hop, before any wrapper hop, and one wrapper hop.  TN1150 requires a
wrapper's embedded volume to be HFS Plus, so a second wrapper is never
valid.  Apple documents no nested partition maps, and neither macOS nor
the boot ROM reads one.  With both limits, plain, wrapped, partitioned
and partitioned-then-wrapped volumes still mount under QEMU.

If you would rather not rely on that, the alternative is to reject only
a hop that does not advance part_start.  Both hops add unsigned offsets,
so the loop then always ends, but a crafted chain of one-sector hops
can cost a synchronous read per sector of the device before it does,
which on slow media such as a CD adds up.  I can send that instead.

Matthias Goergens (2):
  hfs: bound the partition-table hop in hfs_mdb_get()
  hfsplus: bound the wrapper and partition-table hops in
    hfsplus_read_wrapper()

 fs/hfs/mdb.c         | 10 +++++++++-
 fs/hfsplus/wrapper.c | 15 +++++++++++++++
 2 files changed, 24 insertions(+), 1 deletion(-)

-- 
2.55.0