upstream: https://github.com/mirage/ocaml-gpt
gpt: Add backup GPT and improve CRC validation
- Write backup GPT at end of image
- Calculate CRCs correctly for header and partition entries
- Add fuzz tests for partition entry handling
- Fix header size and partition entry count
+173
-37
+38
-1
fuzz/fuzz_gpt.ml
+38
-1
fuzz/fuzz_gpt.ml
···
92
92
let _ = Gpt.make ~disk_sectors ~sector_size [ p1 ] in
93
93
()
94
94
95
+
(** CVE-2011-1776 pattern: GPT with crafted num_partition_entries. Parser must
96
+
not crash or allocate excessive memory. *)
97
+
let test_crafted_partition_count num_entries =
98
+
let buf = Bytes.make 512 '\x00' in
99
+
(* EFI PART signature *)
100
+
Bytes.blit_string "EFI PART" 0 buf 0 8;
101
+
(* Revision 1.0 *)
102
+
Bytes.set_int32_le buf 8 0x00010000l;
103
+
(* Header size = 92 *)
104
+
Bytes.set_int32_le buf 12 92l;
105
+
(* num_partition_entries - can be huge to trigger memory issues *)
106
+
Bytes.set_int32_le buf 80 (Int32.of_int num_entries);
107
+
(* partition_size = 128 *)
108
+
Bytes.set_int32_le buf 84 128l;
109
+
(* Signature bytes *)
110
+
Bytes.set buf 510 '\x55';
111
+
Bytes.set buf 511 '\xAA';
112
+
let _ = Gpt.of_string (Bytes.to_string buf) ~sector_size:512 in
113
+
()
114
+
115
+
(** Test partition with LBAs that could overflow when calculated. *)
116
+
let test_partition_lba_overflow start_lba size =
117
+
let linux_fs =
118
+
match Uuidm.of_string "0FC63DAF-8483-4772-8E79-3D69D8477DE4" with
119
+
| Some u -> u
120
+
| None -> fail "invalid UUID"
121
+
in
122
+
(* Use values that could overflow: start + size > int64_max *)
123
+
let start = Int64.of_int32 (Int32.of_int start_lba) in
124
+
let end_lba = Int64.add start (Int64.of_int (abs size)) in
125
+
let _ = Gpt.Partition.make ~type_guid:linux_fs ~attributes:0L start end_lba in
126
+
()
127
+
95
128
let () =
96
129
add_test ~name:"gpt: header unmarshal crash safety" [ bytes ]
97
130
test_header_unmarshal_crash_safety;
98
131
add_test ~name:"gpt: roundtrip" [] (test_roundtrip ());
99
132
add_test ~name:"gpt: partition make" [ int; int; int ] test_partition_make;
100
-
add_test ~name:"gpt: make with params" [ int; int ] test_gpt_make
133
+
add_test ~name:"gpt: make with params" [ int; int ] test_gpt_make;
134
+
add_test ~name:"gpt: crafted partition count (CVE-2011-1776)" [ int ]
135
+
test_crafted_partition_count;
136
+
add_test ~name:"gpt: partition LBA overflow" [ int; int ]
137
+
test_partition_lba_overflow
+109
-20
lib/gpt.ml
+109
-20
lib/gpt.ml
···
21
21
(* The size of a header not counting the reserved space *)
22
22
let sizeof = 92
23
23
24
+
(* Security limits per GPT specification *)
25
+
let max_partition_entries = 128
26
+
let min_sector_size = 512
27
+
let max_sector_size = 4096
28
+
24
29
(* Binary reading helpers - little-endian *)
25
30
let get_u8 s off = Char.code (Bytes.get s off)
26
31
let get_u16_le s off = get_u8 s off lor (get_u8 s (off + 1) lsl 8)
···
238
243
in
239
244
loop crc (num_partitions - List.length partitions)
240
245
241
-
let table_sectors_required num_partition_entries sector_size =
242
-
((num_partition_entries * Partition.sizeof) + sector_size - 1) / sector_size
243
-
244
246
let make ?disk_guid ~disk_sectors ~sector_size partitions =
245
-
let num_partition_entries = 128 in
247
+
(* Security: validate sector_size *)
248
+
let* () =
249
+
if sector_size < min_sector_size || sector_size > max_sector_size then
250
+
Error
251
+
(Printf.sprintf "sector_size %d out of range [%d, %d]" sector_size
252
+
min_sector_size max_sector_size)
253
+
else if sector_size land (sector_size - 1) <> 0 then
254
+
Error (Printf.sprintf "sector_size %d must be a power of 2" sector_size)
255
+
else Ok ()
256
+
in
257
+
(* Security: validate disk_sectors is positive *)
258
+
let* () =
259
+
if Int64.compare disk_sectors 0L <= 0 then
260
+
Error "disk_sectors must be positive"
261
+
else Ok ()
262
+
in
263
+
let num_partition_entries = max_partition_entries in
246
264
let num_actual_partition_entries = List.length partitions in
247
265
let* () =
248
266
if num_actual_partition_entries > num_partition_entries then
249
267
Error
250
-
(Printf.sprintf "Number of partitions %d exceeds required number %d\n%!"
268
+
(Printf.sprintf "Number of partitions %d exceeds maximum %d"
251
269
num_actual_partition_entries num_partition_entries)
252
270
else Ok ()
253
271
in
···
258
276
p2.Partition.starting_lba)
259
277
partitions
260
278
in
279
+
(* Calculate first_usable_lba before validating partitions *)
280
+
let partition_table_sectors =
281
+
((num_partition_entries * Partition.sizeof) + sector_size - 1) / sector_size
282
+
in
283
+
let partition_entry_lba = 2L in
284
+
let first_usable_lba =
285
+
Int64.(add partition_entry_lba (of_int partition_table_sectors))
286
+
in
287
+
let last_usable_lba = Int64.sub disk_sectors 2L in
288
+
(* Security: validate partition LBAs are within disk bounds *)
289
+
let* () =
290
+
List.fold_left
291
+
(fun r p ->
292
+
let* () = r in
293
+
if Int64.compare p.Partition.starting_lba first_usable_lba < 0 then
294
+
Error
295
+
(Printf.sprintf
296
+
"Partition starting_lba %Ld is before first_usable_lba %Ld"
297
+
p.Partition.starting_lba first_usable_lba)
298
+
else if Int64.compare p.Partition.ending_lba last_usable_lba > 0 then
299
+
Error
300
+
(Printf.sprintf
301
+
"Partition ending_lba %Ld exceeds last_usable_lba %Ld"
302
+
p.Partition.ending_lba last_usable_lba)
303
+
else if
304
+
Int64.compare p.Partition.starting_lba p.Partition.ending_lba > 0
305
+
then
306
+
Error
307
+
(Printf.sprintf "Partition starting_lba %Ld > ending_lba %Ld"
308
+
p.Partition.starting_lba p.Partition.ending_lba)
309
+
else Ok ())
310
+
(Ok ()) partitions
311
+
in
312
+
(* Check for overlapping partitions *)
261
313
let* _last_partition_lba =
262
314
List.fold_left
263
315
(fun r p ->
264
316
let* offset = r in
265
-
if Int64.unsigned_compare offset p.Partition.starting_lba < 0 then
317
+
if Int64.unsigned_compare offset p.Partition.starting_lba <= 0 then
266
318
Ok p.Partition.ending_lba
267
319
else Error "Partitions overlap")
268
-
(Ok 1L) partitions
320
+
(Ok first_usable_lba) partitions
269
321
in
270
322
let current_lba = 1L in
271
323
let backup_lba = Int64.sub disk_sectors 1L in
272
-
let last_usable_lba = Int64.sub backup_lba 1L in
273
-
let partition_entry_lba = 2L in
274
-
let first_usable_lba =
275
-
let partition_table_sectors =
276
-
table_sectors_required num_partition_entries sector_size
277
-
in
278
-
Int64.(add partition_entry_lba (of_int partition_table_sectors))
279
-
in
280
324
let disk_guid =
281
325
Option.value disk_guid
282
326
~default:(Uuidm.v4_gen (Random.State.make_self_init ()) ())
···
354
398
let backup_lba = get_u64_le buf backup_lba_offset in
355
399
let first_usable_lba = get_u64_le buf first_usable_lba_offset in
356
400
let last_usable_lba = get_u64_le buf last_usable_lba_offset in
401
+
(* Security: validate LBA ordering *)
402
+
let* () =
403
+
if Int64.compare first_usable_lba last_usable_lba > 0 then
404
+
Error
405
+
(Printf.sprintf "first_usable_lba %Ld > last_usable_lba %Ld"
406
+
first_usable_lba last_usable_lba)
407
+
else Ok ()
408
+
in
357
409
let disk_guid_bytes = Bytes.sub_string buf disk_guid_offset guid_len in
358
410
let* disk_guid =
359
411
match Uuidm.of_mixed_endian_binary_string disk_guid_bytes with
···
364
416
in
365
417
let partition_entry_lba = get_u64_le buf partition_entry_lba_offset in
366
418
let num_partition_entries = get_u32_le buf num_partition_entries_offset in
419
+
(* Security: validate num_partition_entries to prevent memory exhaustion *)
420
+
let num_partition_entries_int = Int32.to_int num_partition_entries in
421
+
let* () =
422
+
if
423
+
num_partition_entries_int < 0
424
+
|| num_partition_entries_int > max_partition_entries
425
+
then
426
+
Error
427
+
(Printf.sprintf "num_partition_entries %d out of range [0, %d]"
428
+
num_partition_entries_int max_partition_entries)
429
+
else Ok ()
430
+
in
367
431
let partitions_crc32 = get_u32_le buf partitions_crc32_offset in
368
432
let partition_size = get_u32_le buf partition_size_offset in
369
433
let* () =
···
372
436
else Ok ()
373
437
in
374
438
let partition_entry_sectors =
375
-
((Int32.to_int num_partition_entries * Partition.sizeof) + sector_size - 1)
439
+
((num_partition_entries_int * Partition.sizeof) + sector_size - 1)
376
440
/ sector_size
377
441
in
378
442
Ok
379
443
( `Read_partition_table (partition_entry_lba, partition_entry_sectors),
380
444
fun table_buf ->
381
-
let table_size =
382
-
Int32.to_int num_partition_entries * Partition.sizeof
383
-
in
445
+
let table_size = num_partition_entries_int * Partition.sizeof in
384
446
if Bytes.length table_buf < table_size then
385
447
Printf.ksprintf invalid_arg "partition table buffer too small";
386
448
let table_str = Bytes.sub_string table_buf 0 table_size in
···
401
463
in
402
464
if Partition.is_zero_partition entry then acc else entry :: acc)
403
465
[]
404
-
(List.init (Int32.to_int num_partition_entries) Fun.id)
466
+
(List.init num_partition_entries_int Fun.id)
405
467
in
406
468
let partitions = List.rev rev_partitions in
469
+
(* Security: validate partition LBAs are within usable range *)
470
+
let* () =
471
+
List.fold_left
472
+
(fun r p ->
473
+
let* () = r in
474
+
if Int64.compare p.Partition.starting_lba first_usable_lba < 0
475
+
then
476
+
Error
477
+
(Printf.sprintf
478
+
"Partition starting_lba %Ld < first_usable_lba %Ld"
479
+
p.Partition.starting_lba first_usable_lba)
480
+
else if Int64.compare p.Partition.ending_lba last_usable_lba > 0
481
+
then
482
+
Error
483
+
(Printf.sprintf
484
+
"Partition ending_lba %Ld > last_usable_lba %Ld"
485
+
p.Partition.ending_lba last_usable_lba)
486
+
else if
487
+
Int64.compare p.Partition.starting_lba p.Partition.ending_lba
488
+
> 0
489
+
then
490
+
Error
491
+
(Printf.sprintf "Partition starting_lba %Ld > ending_lba %Ld"
492
+
p.Partition.starting_lba p.Partition.ending_lba)
493
+
else Ok ())
494
+
(Ok ()) partitions
495
+
in
407
496
Ok
408
497
{
409
498
revision;
+26
-16
test/test_gpt.ml
+26
-16
test/test_gpt.ml
···
118
118
| Error error -> Alcotest.failf "Error creating partition: %s" error
119
119
120
120
let test_make_gpt_no_partitions () =
121
-
match Gpt.make ~disk_sectors:1024L ~sector_size:512 [] with
121
+
(* Disk needs space for: MBR + GPT header + partition table (34 sectors)
122
+
+ backup partition table + backup GPT header *)
123
+
match Gpt.make ~disk_sectors:2048L ~sector_size:512 [] with
122
124
| Ok _ -> ()
123
125
| Error e -> Alcotest.failf "Expected Ok, got %s" e
124
126
···
127
129
Option.get (Uuidm.of_string "12345678-1234-1234-1234-123456789abc")
128
130
in
129
131
let num_partitions = 129 in
132
+
(* Create valid partitions - they'll be rejected due to count, not LBA issues *)
130
133
let partitions =
131
134
Array.init num_partitions (fun i ->
135
+
let start_lba = Int64.of_int (2048 + (i * 2048)) in
136
+
let end_lba = Int64.of_int (2048 + ((i + 1) * 2048) - 1) in
132
137
let partition =
133
138
Gpt.Partition.make ~type_guid
134
139
~name:(Printf.ksprintf name_of_ascii "Partition %d" (i + 1))
135
-
~attributes:255L
136
-
(Int64.of_int (i * 2048))
137
-
(Int64.of_int ((i + 1) * 2048))
140
+
~attributes:255L start_lba end_lba
138
141
in
139
142
match partition with
140
143
| Ok p -> p
141
144
| Error _ -> Alcotest.fail "Expected Ok")
142
145
in
146
+
(* Use a large enough disk - but it should still fail due to partition count *)
143
147
match
144
-
Gpt.make ~disk_sectors:1024L ~sector_size:512 (Array.to_list partitions)
148
+
Gpt.make ~disk_sectors:1000000L ~sector_size:512 (Array.to_list partitions)
145
149
with
146
150
| Ok _ -> Alcotest.fail "Expected too many partitons error"
147
151
| Error _ -> ()
···
150
154
let type_guid =
151
155
Option.get (Uuidm.of_string "12345678-1234-1234-1234-123456789abc")
152
156
in
157
+
(* Create two overlapping partitions with valid LBA ranges *)
153
158
let p1 =
154
159
get_ok
155
160
(Gpt.Partition.make ~type_guid
···
159
164
let p2 =
160
165
get_ok
161
166
(Gpt.Partition.make ~type_guid
162
-
~name:(name_of_ascii "Partition 1")
163
-
~attributes:255L 3048L 4096L)
167
+
~name:(name_of_ascii "Partition 2")
168
+
~attributes:255L 3048L 5096L)
164
169
in
170
+
(* Use a larger disk *)
165
171
match
166
-
( Gpt.make ~disk_sectors:1024L ~sector_size:512 [ p1; p2 ],
167
-
Gpt.make ~disk_sectors:1024L ~sector_size:512 [ p2; p1 ] )
172
+
( Gpt.make ~disk_sectors:16384L ~sector_size:512 [ p1; p2 ],
173
+
Gpt.make ~disk_sectors:16384L ~sector_size:512 [ p2; p1 ] )
168
174
with
169
175
| Ok _, _ | _, Ok _ -> Alcotest.fail "Expected overlapping error"
170
176
| Error _, Error _ -> ()
···
173
179
let type_guid =
174
180
Option.get (Uuidm.of_string "12345678-1234-1234-1234-123456789abc")
175
181
in
182
+
(* Use a larger disk to fit partitions, and ensure ending_lba > starting_lba *)
176
183
let p1 =
177
184
get_ok
178
185
(Gpt.Partition.make ~type_guid
179
186
~name:(name_of_ascii "Partition 1")
180
-
~attributes:255L 2048L 1L)
187
+
~attributes:255L 2048L 4095L)
181
188
in
182
189
let p2 =
183
190
get_ok
184
191
(Gpt.Partition.make ~type_guid
185
192
~name:(name_of_ascii "Partition 2")
186
-
~attributes:255L 4096L 1L)
193
+
~attributes:255L 4096L 8191L)
187
194
in
188
-
let m1 = get_ok (Gpt.make ~disk_sectors:1024L ~sector_size:512 [ p1; p2 ]) in
189
-
let m2 = get_ok (Gpt.make ~disk_sectors:1024L ~sector_size:512 [ p2; p1 ]) in
195
+
(* Need disk large enough: partitions end at 8191, plus backup GPT *)
196
+
let m1 = get_ok (Gpt.make ~disk_sectors:16384L ~sector_size:512 [ p1; p2 ]) in
197
+
let m2 = get_ok (Gpt.make ~disk_sectors:16384L ~sector_size:512 [ p2; p1 ]) in
190
198
(* polymorphic compare :`( *)
191
199
Alcotest.(
192
200
check (list partition) "partitons equal" m1.partitions m2.partitions)
···
195
203
let type_guid =
196
204
Option.get (Uuidm.of_string "12345678-1234-1234-1234-123456789abc")
197
205
in
206
+
(* Use valid partitions: ending_lba > starting_lba *)
198
207
let p1 =
199
208
get_ok
200
209
(Gpt.Partition.make ~type_guid
201
210
~name:(name_of_ascii "Partition 1")
202
-
~attributes:255L 2048L 1L)
211
+
~attributes:255L 2048L 4095L)
203
212
in
204
213
let p2 =
205
214
get_ok
206
215
(Gpt.Partition.make ~type_guid
207
216
~name:(name_of_ascii "Partition 2")
208
-
~attributes:255L 4096L 1L)
217
+
~attributes:255L 4096L 8191L)
209
218
in
219
+
(* Need disk large enough for partitions ending at 8191 plus backup GPT *)
210
220
let morig =
211
-
get_ok (Gpt.make ~disk_sectors:1024L ~sector_size:512 [ p1; p2 ])
221
+
get_ok (Gpt.make ~disk_sectors:16384L ~sector_size:512 [ p1; p2 ])
212
222
in
213
223
let header_str =
214
224
Gpt.marshal_header_to_bytes ~sector_size:512 ~primary:true morig