base/SOURCES/0021-gpt-try-to-avoid-trusting-unverified-partition-table.patch

From 29a53c93ce063c8272e44f4981201a4752fc6ba1 Mon Sep 17 00:00:00 2001
From: Peter Jones <pjones@redhat.com>
Date: Tue, 9 May 2017 14:20:13 -0400
Subject: [PATCH 21/24] gpt: try to avoid trusting unverified partition table
 data.

Covscan complains thusly:
 4. efivar-31/src/gpt.c:338: tainted_data_return: Function "alloc_read_gpt_header" returns tainted data.
 7. efivar-31/src/gpt.c:311:2: tainted_data_argument: Function "read_lba" taints argument "gpt".
12. efivar-31/src/gpt.c:245:2: tainted_data_argument: Calling function "read" taints parameter "*iobuf". [Note: The source code implementation of the function has been overridden by a builtin model.]
13. efivar-31/src/gpt.c:246:2: tainted_data_transitive: "memcpy" taints argument "buffer" because argument "iobuf" is tainted. [Note: The source code implementation of the function has been overridden by a builtin model.]
16. efivar-31/src/gpt.c:316:2: return_tainted_data: Returning tainted variable "gpt".
17. efivar-31/src/gpt.c:338: var_assign: Assigning: "*gpt" = "alloc_read_gpt_header", which taints "*gpt".
26. efivar-31/src/gpt.c:382: tainted_data: Passing tainted variable "(*gpt)->num_partition_entries" to a tainted sink.
27. efivar-31/src/gpt.c:272:15: var_assign_alias: Assigning: "count" = "(__u32)(__le32)gpt->num_partition_entries * (__u32)(__le32)gpt->sizeof_partition_entry". Both are now tainted.
30. efivar-31/src/gpt.c:278:2: tainted_data_sink_lv_call: Passing tainted variable "count" to tainted data sink "malloc".

Hopefully this patch validates num_partition_entries and
sizeof_partition_entry well enough...

Signed-off-by: Peter Jones <pjones@redhat.com>
---
 src/disk.c |   3 +-
 src/gpt.c  | 190 ++++++++++++++++++++++++++++++++++++++++++++++++++++++-------
 src/gpt.h  |   3 +-
 3 files changed, 173 insertions(+), 23 deletions(-)

diff --git a/src/disk.c b/src/disk.c
index 91d636d..0a7a769 100644
--- a/src/disk.c
+++ b/src/disk.c
@@ -225,7 +225,8 @@ get_partition_info(int fd, uint32_t options,
 						  signature,
 						  mbr_type,
 						  signature_type,
-			(options & EFIBOOT_OPTIONS_IGNORE_PMBR_ERR)?1:0);
+			(options & EFIBOOT_OPTIONS_IGNORE_PMBR_ERR)?1:0,
+			sector_size);
 	if (gpt_invalid) {
 		mbr_invalid = msdos_disk_get_partition_info(fd,
 			(options & EFIBOOT_OPTIONS_WRITE_SIGNATURE)?1:0,
diff --git a/src/gpt.c b/src/gpt.c
index e9c713b..7baa992 100644
--- a/src/gpt.c
+++ b/src/gpt.c
@@ -29,6 +29,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <sys/param.h>
 #include <sys/stat.h>
 #include <sys/utsname.h>
 #include <unistd.h>
@@ -266,11 +267,10 @@ read_lba(int fd, uint64_t lba, void *buffer, size_t bytes)
  * Notes: remember to free pte when you're done!
  */
 static gpt_entry *
-alloc_read_gpt_entries(int fd, gpt_header * gpt)
+alloc_read_gpt_entries(int fd, uint32_t nptes, uint32_t ptesz, uint64_t ptelba)
 {
 	gpt_entry *pte;
-	size_t count = __le32_to_cpu(gpt->num_partition_entries) *
-		__le32_to_cpu(gpt->sizeof_partition_entry);
+	size_t count = nptes * ptesz;
 
 	if (!count)
 		return NULL;
@@ -280,8 +280,7 @@ alloc_read_gpt_entries(int fd, gpt_header * gpt)
 		return NULL;
 
 	memset(pte, 0, count);
-	if (!read_lba(fd, __le64_to_cpu(gpt->partition_entry_lba), pte,
-		      count)) {
+	if (!read_lba(fd, ptelba, pte, count)) {
 		free(pte);
 		return NULL;
 	}
@@ -317,6 +316,65 @@ alloc_read_gpt_header(int fd, uint64_t lba)
 }
 
 /**
+ * validate_nptes(): Tries to ensure that nptes is a reasonable value
+ * @first_block is the beginning LBA to bound the table
+ * @pte_start is the starting LBA of the partition table
+ * @last_block is the end LBA of to bound the table
+ * @ptesz is the size of a partition table entry
+ * @nptes is the number of entries we have.
+ * @blksz is the block size of the device.
+ *
+ * Description: returns 0 if the partition table doesn't fit, 1 if it does
+ */
+static int
+validate_nptes(uint64_t first_block, uint64_t pte_start, uint64_t last_block,
+	       uint32_t ptesz, uint32_t nptes, uint32_t blksz)
+{
+	uint32_t min_entry_size = sizeof(gpt_entry);
+	uint32_t min_entry_size_mod = 128 - sizeof(gpt_entry) % 128;
+	uint64_t max_blocks, max_bytes;
+
+	if (min_entry_size_mod == 128)
+		min_entry_size_mod = 0;
+	min_entry_size += min_entry_size_mod;
+
+	if (ptesz < min_entry_size)
+		return 0;
+
+	if (pte_start < first_block || pte_start > last_block)
+		return 0;
+
+	max_blocks = last_block - pte_start;
+	if (UINT64_MAX / blksz < max_blocks)
+		return 0;
+
+	max_bytes = max_blocks * blksz;
+	if (UINT64_MAX / ptesz < max_bytes)
+		return 0;
+
+	if (ptesz > max_bytes / nptes)
+		return 0;
+
+	if (max_bytes / ptesz < nptes)
+		return 0;
+
+	return 1;
+}
+
+static int
+check_lba(uint64_t lba, uint64_t lastlba, char *name)
+{
+	if (lba > lastlba) {
+		if (report_errors)
+			fprintf(stderr,
+				"Invalid %s LBA %"PRIx64" max:%"PRIx64"\n",
+				name, lba, lastlba);
+		return 0;
+	}
+	return 1;
+}
+
+/**
  * is_gpt_valid() - tests one GPT header and PTEs for validity
  * @fd  is an open file descriptor to the whole disk
  * @lba is the logical block address of the GPT header to test
@@ -328,10 +386,12 @@ alloc_read_gpt_header(int fd, uint64_t lba)
  */
 static int
 is_gpt_valid(int fd, uint64_t lba,
-	     gpt_header ** gpt, gpt_entry ** ptes)
+	     gpt_header ** gpt, gpt_entry ** ptes,
+	     uint32_t logical_block_size)
 {
 	int rc = 0;		/* default to not valid */
 	uint32_t crc, origcrc;
+	uint64_t max_device_lba = last_lba(fd);
 
 	if (!gpt || !ptes)
 		return 0;
@@ -343,7 +403,7 @@ is_gpt_valid(int fd, uint64_t lba,
 		if (report_errors)
 			fprintf(stderr,
 				"GUID Partition Table Header signature is wrong"
-			       ": %" PRIx64" != %" PRIx64 "\n",
+			       ": %"PRIx64" != %"PRIx64"\n",
 			       (uint64_t)__le64_to_cpu((*gpt)->signature),
 			       GPT_HEADER_SIGNATURE);
 		free(*gpt);
@@ -351,6 +411,20 @@ is_gpt_valid(int fd, uint64_t lba,
 		return rc;
 	}
 
+	uint32_t hdrsz = __le32_to_cpu((*gpt)->header_size);
+	uint32_t hdrmin = MAX(92,
+			      sizeof(gpt_header) - sizeof((*gpt)->reserved2));
+	if (hdrsz < hdrmin || hdrsz > logical_block_size) {
+		if (report_errors)
+			fprintf(stderr,
+				"GUID Partition Table Header size is invalid (%d < %d < %d)\n",
+				hdrmin, hdrsz,
+				logical_block_size);
+		free (*gpt);
+		*gpt = NULL;
+		return rc;
+	}
+
 	/* Check the GUID Partition Table Header CRC */
 	origcrc = __le32_to_cpu((*gpt)->header_crc32);
 	(*gpt)->header_crc32 = 0;
@@ -369,26 +443,97 @@ is_gpt_valid(int fd, uint64_t lba,
 
 	/* Check that the my_lba entry points to the LBA
 	 * that contains the GPT we read */
-	if (__le64_to_cpu((*gpt)->my_lba) != lba) {
+	uint64_t mylba = __le64_to_cpu((*gpt)->my_lba);
+	uint64_t altlba = __le64_to_cpu((*gpt)->alternate_lba);
+	if (mylba != lba && altlba != lba) {
 		if (report_errors)
 			fprintf(stderr,
-				"my_lba %"PRIx64 "x != lba %"PRIx64 "x.\n",
-				(uint64_t)__le64_to_cpu((*gpt)->my_lba), lba);
+				"lba %"PRIx64" != lba %"PRIx64".\n",
+				mylba, lba);
+err:
 		free(*gpt);
 		*gpt = NULL;
 		return 0;
 	}
 
-	if (!(*ptes = alloc_read_gpt_entries(fd, *gpt))) {
+	if (!check_lba(mylba, max_device_lba, "GPT"))
+		goto err;
+
+	if (!check_lba(altlba, max_device_lba, "GPT Alt"))
+		goto err;
+
+	uint64_t ptelba = __le64_to_cpu((*gpt)->partition_entry_lba);
+	uint64_t fulba = __le64_to_cpu((*gpt)->first_usable_lba);
+	uint64_t lulba = __le64_to_cpu((*gpt)->last_usable_lba);
+	uint32_t nptes = __le32_to_cpu((*gpt)->num_partition_entries);
+	uint32_t ptesz = __le32_to_cpu((*gpt)->sizeof_partition_entry);
+
+	if (!check_lba(ptelba, max_device_lba, "PTE"))
+		goto err;
+	if (!check_lba(fulba, max_device_lba, "First Usable"))
+		goto err;
+	if (!check_lba(lulba, max_device_lba, "Last Usable"))
+		goto err;
+
+	if (ptesz < sizeof(gpt_entry) || ptesz % 128 != 0) {
+		if (report_errors)
+			fprintf(stderr,
+				"Invalid GPT entry size is %d.\n",
+				ptesz);
+		goto err;
+	}
+
+	/* There's really no good answer to maximum bounds, but this large
+	 * would be completely absurd, so... */
+	if (nptes > 1024) {
+		if (report_errors)
+			fprintf(stderr,
+				"Not honoring insane number of Partition Table Entries 0x%"PRIx32".\n",
+				nptes);
+
+		goto err;
+	}
+
+	if (ptesz > 4096) {
+		if (report_errors)
+			fprintf(stderr,
+				"Not honoring insane Partition Table Entry size 0x%"PRIx32".\n",
+				ptesz);
+		goto err;
+	}
+
+	uint64_t pte_blocks;
+	uint64_t firstlba, lastlba;
+
+	if (altlba > mylba) {
+		firstlba = mylba + 1;
+		lastlba = fulba;
+		pte_blocks = fulba - ptelba;
+		rc = validate_nptes(firstlba, ptelba, fulba,
+				    ptesz, nptes, logical_block_size);
+	} else {
+		firstlba = lulba;
+		lastlba = mylba;
+		pte_blocks = mylba - ptelba;
+		rc = validate_nptes(lulba, ptelba, mylba,
+				    ptesz, nptes, logical_block_size);
+	}
+	if (!rc) {
+		if (report_errors)
+			fprintf(stderr,
+				"%"PRIu32" partition table entries with size 0x%"PRIx32" doesn't fit in 0x%"PRIx64" blocks between 0x%"PRIx64" and 0x%"PRIx64".\n",
+				nptes, ptesz, pte_blocks, firstlba, lastlba);
+		goto err;
+	}
+
+	if (!(*ptes = alloc_read_gpt_entries(fd, nptes, ptesz, ptelba))) {
 		free(*gpt);
 		*gpt = NULL;
 		return 0;
 	}
 
 	/* Check the GUID Partition Entry Array CRC */
-	crc = efi_crc32(*ptes,
-			__le32_to_cpu((*gpt)->num_partition_entries) *
-			__le32_to_cpu((*gpt)->sizeof_partition_entry));
+	crc = efi_crc32(*ptes, nptes * ptesz);
 	if (crc != __le32_to_cpu((*gpt)->partition_entry_array_crc32)) {
 		if (report_errors)
 		     fprintf(stderr,
@@ -519,7 +664,7 @@ compare_gpts(gpt_header *pgpt, gpt_header *agpt, uint64_t lastlba)
  */
 static int
 find_valid_gpt(int fd, gpt_header ** gpt, gpt_entry ** ptes,
-	       int ignore_pmbr_err)
+	       int ignore_pmbr_err, int logical_block_size)
 {
 	int good_pgpt = 0, good_agpt = 0, good_pmbr = 0;
 	gpt_header *pgpt = NULL, *agpt = NULL;
@@ -535,16 +680,18 @@ find_valid_gpt(int fd, gpt_header ** gpt, gpt_entry ** ptes,
 
 	lastlba = last_lba(fd);
 	good_pgpt = is_gpt_valid(fd, GPT_PRIMARY_PARTITION_TABLE_LBA,
-				 &pgpt, &pptes);
+				 &pgpt, &pptes, logical_block_size);
 	if (good_pgpt) {
 		good_agpt = is_gpt_valid(fd,
 					 __le64_to_cpu(pgpt->alternate_lba),
-					 &agpt, &aptes);
+					 &agpt, &aptes, logical_block_size);
 		if (!good_agpt) {
-			good_agpt = is_gpt_valid(fd, lastlba, &agpt, &aptes);
+			good_agpt = is_gpt_valid(fd, lastlba, &agpt, &aptes,
+						 logical_block_size);
 		}
 	} else {
-		good_agpt = is_gpt_valid(fd, lastlba, &agpt, &aptes);
+		good_agpt = is_gpt_valid(fd, lastlba, &agpt, &aptes,
+					 logical_block_size);
 	}
 
 	/* The obviously unsuccessful case */
@@ -634,7 +781,7 @@ __attribute__((__visibility__ ("hidden")))
 gpt_disk_get_partition_info(int fd, uint32_t num, uint64_t * start,
 			    uint64_t * size, uint8_t *signature,
 			    uint8_t * mbr_type, uint8_t * signature_type,
-			    int ignore_pmbr_error)
+			    int ignore_pmbr_error, int logical_block_size)
 {
 	gpt_header *gpt = NULL;
 	gpt_entry *ptes = NULL, *p;
@@ -644,7 +791,8 @@ gpt_disk_get_partition_info(int fd, uint32_t num, uint64_t * start,
 	if (report)
 		report_errors = 1;
 
-	rc = find_valid_gpt(fd, &gpt, &ptes, ignore_pmbr_error);
+	rc = find_valid_gpt(fd, &gpt, &ptes, ignore_pmbr_error,
+			    logical_block_size);
 	if (rc < 0)
 		return rc;
 
diff --git a/src/gpt.h b/src/gpt.h
index 2249b59..678ee37 100644
--- a/src/gpt.h
+++ b/src/gpt.h
@@ -147,7 +147,8 @@ extern int gpt_disk_get_partition_info (int fd, uint32_t num, uint64_t *start,
 					uint64_t *size, uint8_t *signature,
 					uint8_t *mbr_type,
 					uint8_t *signature_type,
-					int ignore_pmbr_error)
+					int ignore_pmbr_error,
+					int logical_sector_size)
 	__attribute__((__nonnull__ (3, 4, 5, 6, 7)))
 	__attribute__((__visibility__ ("hidden")));
 
-- 
2.12.2