DF-0133 / fix.diff
diff --git a/sys/kern/subr_diskmbr.c b/sys/kern/subr_diskmbr.c --- a/sys/kern/subr_diskmbr.c +++ b/sys/kern/subr_diskmbr.c @@ -500,9 +500,14 @@ } ssp->dss_nslices = slice; - /* If we found any more slices, recursively find all the subslices. */ + /* If we found any more slices, recursively find all the subslices. + * Cap the total number of extended-partition records we will read to + * avoid algorithmic-complexity blowups from self-referencing EBRs. + */ for (dospart = 0; dospart < NDOSPART; dospart++) { if (ext_sizes[dospart] != 0) { + if (ssp->dss_nslices >= MAX_SLICES) + break; mbr_extended(dev, info, ssp, ext_offsets[dospart], ext_sizes[dospart], base_ext_offset, nsectors, ntracks, mbr_offset, ++level); |