commit a96e0e16dd686338254e1c82b3621d0ce5847e36
author Jasraj Bedi <jasrajb@google.com> Sat Jun 06 01:42:05 2020 +0000
committer Sterling Huber <hubers@google.com> Mon Aug 24 15:22:39 2020 -0700
tree ce6b61f5023d0a173a7b606df9b3edae217e2c22
parent 99bbb78a37210775632acccd87035bf136325251

RESTRICT AUTOMERGE
ANDROID: Fix negative stack write in sgdisk

A maliciously formatted USB or SD Card device when inserted into an Android device could crash sgdisk. This crash occurs because sgdisk does does not validate the number of cyclic partitions, which leads to an integer underflow ultimately causing a negative indexed stack write.

Fix this by making sure the number of partitions don't go negative.

After the fix, sgdisk detects the broken GPT and partitions it correctly

Author: jasrajb@google.com
Bug: 158063095
Test: before fix, sgdisk crashed when USB with malicious GPT was inserted
Test: after fix, sgdisk didn't crash
Test: went through the "formatting" wizard with a malicious GPT and sgdisk successfully reformatted it to vfat
Change-Id: Ie0257a68f6a0140b98fb7d104dc2ffd1f5c2afde

basicmbr.cc

diff --git a/basicmbr.cc b/basicmbr.cc
index 23f35b4..81e42ca 100644
--- a/basicmbr.cc
+++ b/basicmbr.cc
@@ -260,7 +260,8 @@
          if (EbrLocations[i] == offset) { // already read this one; infinite logical partition loop!
             cerr << "Logical partition infinite loop detected! This is being corrected.\n";
             allOK = -1;
-            partNum -= 1;
+            if(partNum > 0) //don't go negative
+                partNum -= 1;
          } // if
       } // for
       EbrLocations[partNum] = offset;