Skip to content

Commit 786032d

Browse files
pagabucNikolajSchlej
authored andcommitted
Fix for crash-f49d257a34c42fb5620c3153569c573aa51802ec: stack-overflow in parseVolumeNonUefiData
Malformed firmware can cause infinite recursion between parseVolumeBody and parseVolumeNonUefiData when the parent volume has the same offset as the current item. Add a recursion guard to break the cycle. Crash report (crash-f49d257a34c42fb5620c3153569c573aa51802ec): --- ERROR: AddressSanitizer: stack-overflow on address 0x7ffdde142fd8 #0 in TreeModel::base treemodel.cpp #1 in TreeModel::base treemodel.cpp:173 ---
1 parent 1d98f22 commit 786032d

File tree

1 file changed

+5
-1
lines changed

1 file changed

+5
-1
lines changed

common/ffsparser.cpp

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1874,7 +1874,11 @@ USTATUS FfsParser::parseVolumeNonUefiData(const UByteArray & data, const UINT32
18741874
// Sanity check
18751875
if (!index.isValid())
18761876
return U_INVALID_PARAMETER;
1877-
1877+
1878+
// If parent has the same offset as this item, then we are in infinite recursion, so we break here.
1879+
if (model->offset(index) == localOffset)
1880+
return U_INVALID_PARAMETER;
1881+
18781882
// Get info
18791883
UString info = usprintf("Full size: %Xh (%u)", (UINT32)data.size(), (UINT32)data.size());
18801884

0 commit comments

Comments
 (0)