Bug#872590: libisofs6: integer overflow in susp_iter_next()

2017-08-21 Thread Thomas Schmitt
Hi, all the testing did not catch the new bug by which i prevented multi-session reading. It only showed up with the first incremental backup run after installing the new xorriso version on my workstation. Hopefully fixed by https://dev.lovelyhq.com/libburnia/libisofs/commit/a7152f57942c01f468

Bug#872590: libisofs6: integer overflow in susp_iter_next()

2017-08-19 Thread Thomas Schmitt
Hi, the immediate trigger of the bug is fixed by commit https://dev.lovelyhq.com/libburnia/libisofs/commit/91490d5f34422d514b042a9e597be8d614a3a1ea "Preventing use of zero sized SUSP CE entry which causes SIGSEGV. Debian bug 872590. Thanks Jakub Wilk and American Fuzzy Lop." Further i ins

Bug#872590: libisofs6: integer overflow in susp_iter_next()

2017-08-19 Thread Thomas Schmitt
Hi, this is not so eay to fix. Lots of potential holes for the rabbit to sneak in. A big problem is this plan of my predecessor developer in libisofs: /* read all blocks needed to cache the full CE */ The continuation area is allowed to be up to 4 GiB of size. iter->ce_off is the uin

Bug#872590: libisofs6: integer overflow in susp_iter_next()

2017-08-18 Thread Jakub Wilk
Package: libisofs6 Version: 1.4.6-1 The susp_iter_next() function does the following: nblocks = DIV_UP(iter->ce_off + iter->ce_len, BLOCK_SIZE); iter->buffer = realloc(iter->buffer, nblocks * BLOCK_SIZE); for (block = 0; block < nblocks; ++block) { /* ... */ } iter->base = iter->