Re: Proposal v2: fs/iso9660: Prevent skipping CE or ST at start of continuation area

[Thomas Schmitt]

Hi,

i created another bad ISO which i expect to lead to an endless loop in
existing GRUB (i.e. before applying the proposed change).

Both ISOs can be downloaded as gzip-compressed files now:

  http://scdbackup.webframe.org/ce_loop.iso.gz
  SHA256: d86b73b0cc260968f50c30a5207b798f5fc2396233aee5eb3cedf9cef069f3c2

  http://scdbackup.webframe.org/ce_loop2.iso.gz
  SHA256: a6bde0c1562de8959d783bca0a79ad750da2bc129bdea2362b4a7c3e83426b2c

They are smaller than 1 KB and expand to 128 KiB, each.

(Please do not load these ISOs into existing xorriso programs by commands
like -indev. ce_loop.iso leads to SIGSEGV. ce_loop2.iso leads to an
endless loop. The libisofs code fix is only in git for now.)

------------------------------------------------------------------------
Test proposals for GRUB:

If reading ce_loop.iso by GRUB leads to an error message, then my proposed
change is in effect and protected against endless loops.
Original GRUB is supposed to just ignore that situation, because it skips
over the CE entry by mistake.

If reading ce_loop2.iso by GRUB leads to an error message, then the
proposed safety precaution against endless loops is in effect.
I expect unpatched GRUB to loop endlessly with this ISO.

------------------------------------------------------------------------
About the production of ce_loop2.iso:

The CE entry of its file /x points to a dummy SUSP entry XY of length 8
which sits directly before the CE entry. So this dummy entry is the
first to be read by GRUB from the pseudo-contination area, gets processed
by the hook() function (with no side effects), and is then followed by
the CE entry.
Because of the existence of the XY entry, i expect the CE entry not to
be skipped by existing GRUB.

  # Production begins by the bad ISO of January 9 where the CE entry
  # points to itself
  cp ce_loop.iso ce_loop2.iso

  # Cut out a copy of the bad CE entry
  dd if=ce_loop2.iso bs=1 skip=102734 count=28 of=ce_entry

  # After the CE entry is plenty of unused space in the same block.
  # The length of the directory entry of /x plus 8 will not exceed 255.
  # So put the copy back with an offset of 8 bytes.
  dd if=ce_entry bs=1 seek=102742 conv=notrunc of=ce_loop2.iso

  # Rename the old CE entry head to XY
  echo "XY" | dd bs=1 seek=102734 count=2 conv=notrunc of=ce_loop2.iso

  # Give it the length of 8
  echo $'\x08' | dd bs=1 seek=102736 count=1 conv=notrunc of=ce_loop2.iso

  # Set in the new CE entry the continuation area length to 8 + 28 = 36
  echo $'\x24' | dd bs=1 seek=102762 count=1 conv=notrunc of=ce_loop2.iso
  echo $'\x24' | dd bs=1 seek=102769 count=1 conv=notrunc of=ce_loop2.iso

  # Change the length of the directory record from 134 to 142
  echo $'\x8e' |  dd bs=1 seek=102628 count=1 conv=notrunc of=ce_loop2.iso

The resulting bytes of the whole directory record of /x are then:

000190e0 :    ..  ..  ..  ..  8e  00  37  00  00  00  00  00  00  37  02  00
               .   .   .   .           7                           7
  102624 :   ... ... ... ... 142   0  55   0   0   0   0   0   0  55   2   0

000190f0 :    00  00  00  00  00  02  7b  01  09  08  08  1c  00  00  00  00
                                       {
  102640 :     0   0   0   0   0   2 123   1   9   8   8  28   0   0   0   0

00019100 :    01  00  00  01  04  58  2e  3b  31  00  50  58  24  01  a4  81
                                   X   .   ;   1       P   X   $
  102656 :     1   0   0   1   4  88  46  59  49   0  80  88  36   1 164 129

00019110 :    00  00  00  00  81  a4  01  00  00  00  00  00  00  01  e8  03

  102672 :     0   0   0   0 129 164   1   0   0   0   0   0   0   1 232   3

00019120 :    00  00  00  00  03  e8  e8  03  00  00  00  00  03  e8  54  46
                                                                       T   F
  102688 :     0   0   0   0   3 232 232   3   0   0   0   0   3 232  84  70

00019130 :    1a  01  0e  7b  01  09  08  08  1c  00  7b  01  09  08  08  2f
                           {                           {                   /
  102704 :    26   1  14 123   1   9   8   8  28   0 123   1   9   8   8  47

00019140 :    00  7b  01  09  08  08  1c  00  4e  4d  06  01  00  78  58  59
                   {                           N   M               x   X   Y
  102720 :     0 123   1   9   8   8  28   0  78  77   6   1   0 120  88  89

00019150 :    08  01  32  00  00  00  43  45  1c  01  32  00  00  00  00  00
                       2               C   E           2
  102736 :     8   1  50   0   0   0  67  69  28   1  50   0   0   0   0   0

00019160 :    00  32  4e  01  00  00  00  00  01  4e  24  00  00  00  00  00
                   2   N                           N   $
  102752 :     0  50  78   1   0   0   0   0   1  78  36   0   0   0   0   0

00019170 :    00  24  ..  ..  ..  ..  ..  ..  ..  ..  ..  ..  ..  ..  ..  ..
                   $   .   .   .   .   .   .   .   .   .   .   .   .   .   .
  102768 :     0  36 ... ... ... ... ... ... ... ... ... ... ... ... ... ...

------------------------------------------------------------------------

Have a nice day :)

Thomas