From 50d1594c2e6142a3b51d2143c74027480df082e0 Mon Sep 17 00:00:00 2001
From: Karel Zak <kzak@redhat.com>
Date: Tue, 12 Jul 2016 13:34:54 +0200
Subject: [PATCH] libblkid: avoid non-empty recursion in EBR

This is extension to the patch 7164a1c34d18831ac61c6744ad14ce916d389b3f.

We also need to detect non-empty recursion in the EBR chain. It's
possible to create standard valid logical partitions and in the last one
points back to the EBR chain. In this case all offsets will be non-empty.

Unfortunately, it's valid to create logical partitions that are not in
the "disk order" (sorted by start offset). So link somewhere back is
valid, but this link cannot points to already existing partition
(otherwise we will see recursion).

This patch forces libblkid to ignore duplicate logical partitions, the
duplicate chain segment is interpreted as non-data segment, after 100
iterations with non-data segments it will break the loop -- no memory
is allocated in this case by the loop.

Addresses: https://bugzilla.redhat.com/show_bug.cgi?id=1349536
References: http://seclists.org/oss-sec/2016/q3/40
Signed-off-by: Karel Zak <kzak@redhat.com>
---
 libblkid/src/partitions/dos.c        |  7 +++++++
 libblkid/src/partitions/partitions.c | 14 ++++++++++++++
 libblkid/src/partitions/partitions.h |  2 ++
 3 files changed, 23 insertions(+)

diff --git a/libblkid/src/partitions/dos.c b/libblkid/src/partitions/dos.c
index e79f124..2a64140 100644
--- a/libblkid/src/partitions/dos.c
+++ b/libblkid/src/partitions/dos.c
@@ -105,6 +105,13 @@ static int parse_dos_extended(blkid_probe pr, blkid_parttable tab,
 					continue;
 			}
 
+			/* Avoid recursive non-empty links, see ct_nodata counter */
+			if (blkid_partlist_get_partition_by_start(ls, abs_start)) {
+				DBG(LOWPROBE, ul_debug("#%d: EBR duplicate data partition [abs start=%u] -- ignore",
+							i + 1, abs_start));
+				continue;
+			}
+
 			par = blkid_partlist_add_partition(ls, tab, abs_start, size);
 			if (!par)
 				return -ENOMEM;
diff --git a/libblkid/src/partitions/partitions.c b/libblkid/src/partitions/partitions.c
index 806fced..5332097 100644
--- a/libblkid/src/partitions/partitions.c
+++ b/libblkid/src/partitions/partitions.c
@@ -935,6 +935,20 @@ blkid_partition blkid_partlist_get_partition(blkid_partlist ls, int n)
 	return &ls->parts[n];
 }
 
+blkid_partition blkid_partlist_get_partition_by_start(blkid_partlist ls, uint64_t start)
+{
+	int i, nparts;
+	blkid_partition par;
+
+	nparts = blkid_partlist_numof_partitions(ls);
+	for (i = 0; i < nparts; i++) {
+		par = blkid_partlist_get_partition(ls, i);
+		if ((uint64_t) blkid_partition_get_start(par) == start)
+			return par;
+	}
+	return NULL;
+}
+
 /**
  * blkid_partlist_get_partition_by_partno
  * @ls: partitions list
diff --git a/libblkid/src/partitions/partitions.h b/libblkid/src/partitions/partitions.h
index 7ec03b2..1d99fb6 100644
--- a/libblkid/src/partitions/partitions.h
+++ b/libblkid/src/partitions/partitions.h
@@ -21,6 +21,8 @@ extern int blkid_partlist_increment_partno(blkid_partlist ls);
 
 extern blkid_partition blkid_partlist_get_parent(blkid_partlist ls);
 
+extern blkid_partition blkid_partlist_get_partition_by_start(blkid_partlist ls, uint64_t start);
+
 extern int blkid_partitions_do_subprobe(blkid_probe pr,
 			blkid_partition parent, const struct blkid_idinfo *id);