Summary: | makefs: Coverity CID 977470: Writes slightly wrong El Torito Boot Record | ||
---|---|---|---|
Product: | Base System | Reporter: | scdbackup |
Component: | bin | Assignee: | Ed Maste <emaste> |
Status: | Closed FIXED | ||
Severity: | Affects Some People | CC: | avos, emaste, ngie |
Priority: | --- | Keywords: | patch |
Version: | CURRENT | ||
Hardware: | Any | ||
OS: | Any | ||
See Also: | https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=203531 |
Description
scdbackup
2015-10-08 18:51:13 UTC
Also present in NetBSD. http://cvsweb.netbsd.org/bsdweb.cgi/src/usr.sbin/makefs/cd9660/cd9660_eltorito.c?annotate=1.17.2.3 359: cd9660_bothendian_dword(first_sector, 360: diskStructure->boot_descriptor->boot_catalog_pointer); http://cvsweb.netbsd.org/bsdweb.cgi/src/usr.sbin/makefs/cd9660/cd9660_eltorito.h?annotate=1.5 67: u_char boot_catalog_pointer [ISODCL(0x47,0x4A)]; 68: u_char unused2 [ISODCL(0x4B,0x7FF)]; 69: } boot_volume_descriptor; Handing a number of makefs, mtree, and msdosfs bugs in my queue over to emaste@. Reset assignee - I am not currently looking at this PR. committed referencing the other makefs PR by accident: commit 9f2a525360473a778f91021e3be58fd4bfd72ee5 (HEAD -> main, freebsd/main) Author: Ed Maste <emaste@FreeBSD.org> Date: Thu Mar 23 13:02:44 2023 -0400 makefs: correct El Torito bood record The boot catalog pointer is a DWord, but we previously populated it via cd9660_bothendian_dword which overwrote four unused bytes following it. See El Torito 1.0 (1995) Figure 7 for details. PR: 203531 Reported by: Coverity Scan Reported by: Thomas Schmitt <scdbackup@gmx.net> Reviewed by: kevans CID: 977470 Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D39231 A commit in branch stable/13 references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=b95746135307c8146e342e55928bc27e1521f035 commit b95746135307c8146e342e55928bc27e1521f035 Author: Ed Maste <emaste@FreeBSD.org> AuthorDate: 2023-03-23 17:02:44 +0000 Commit: Ed Maste <emaste@FreeBSD.org> CommitDate: 2023-04-10 13:37:40 +0000 makefs: correct El Torito bood record The boot catalog pointer is a DWord, but we previously populated it via cd9660_bothendian_dword which overwrote four unused bytes following it. See El Torito 1.0 (1995) Figure 7 for details. PR: 203531, 203646 Reported by: Coverity Scan Reported by: Thomas Schmitt <scdbackup@gmx.net> Reviewed by: kevans CID: 977470 Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D39231 (cherry picked from commit 9f2a525360473a778f91021e3be58fd4bfd72ee5) usr.sbin/makefs/cd9660/cd9660_eltorito.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) |