DragonFlyBSD Kernel Audit
DF-0133 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/kern/subr_diskmbr.c b/sys/kern/subr_diskmbr.c
--- a/sys/kern/subr_diskmbr.c
+++ b/sys/kern/subr_diskmbr.c
@@ -500,9 +500,14 @@
 	}
 	ssp->dss_nslices = slice;
 
-	/* If we found any more slices, recursively find all the subslices. */
+	/* If we found any more slices, recursively find all the subslices.
+	 * Cap the total number of extended-partition records we will read to
+	 * avoid algorithmic-complexity blowups from self-referencing EBRs.
+	 */
 	for (dospart = 0; dospart < NDOSPART; dospart++) {
 		if (ext_sizes[dospart] != 0) {
+			if (ssp->dss_nslices >= MAX_SLICES)
+				break;
 			mbr_extended(dev, info, ssp, ext_offsets[dospart],
 				     ext_sizes[dospart], base_ext_offset,
 				     nsectors, ntracks, mbr_offset, ++level);