[PATCH master 3/4] partitions: dos: bound extended partition chain

[Ahmad Fatoum]

dos_extended_partition() follows the EBR chain by reading each logical
partition's link entry (the second entry in the EBR) to locate the next
EBR. The loop is an unbounded while (1) and thus could keep running
until barebox runs out of memory.

Bound it at MAX_PARTITION to fix this.

Fixes: 57392a862d40 ("partition: allocate struct partition in parser")
Assisted-by: Claude:fable-5
Signed-off-by: Ahmad Fatoum <a.fatoum at pengutronix.de>
---
 common/partitions/dos.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/common/partitions/dos.c b/common/partitions/dos.c
index e5286cb6eb1f..3d9e6e67c676 100644
--- a/common/partitions/dos.c
+++ b/common/partitions/dos.c
@@ -129,11 +129,11 @@ static void dos_extended_partition(struct block_device *blk, struct dos_partitio
 	uint8_t *buf = xmalloc(BLOCKSIZE(blk));
 	uint32_t ebr_sector = partition->first_sec;
 	struct partition_entry *table = (struct partition_entry *)&buf[0x1be];
-	unsigned partno = 4;
+	unsigned partno;
 	struct dos_partition *dpart;
 	struct partition *pentry;
 
-	while (1) {
+	for (partno = 4; partno < MAX_PARTITION; partno++) {
 		int rc, i;
 
 		dev_dbg(blk->dev, "expect EBR in sector 0x%x\n", ebr_sector);
@@ -176,8 +176,6 @@ static void dos_extended_partition(struct block_device *blk, struct dos_partitio
 
 		list_add_tail(&pentry->list, &dpd->pd.partitions);
 
-		partno++;
-
 		/* the second entry defines the start of the next ebr if != 0 */
 		if (get_unaligned_le32(&table[1].partition_start))
 			ebr_sector = partition->first_sec +
@@ -186,6 +184,12 @@ static void dos_extended_partition(struct block_device *blk, struct dos_partitio
 			break;
 	}
 
+	/* bound the EBR chain: a cyclic link would loop forever */
+	if (partno == MAX_PARTITION) {
+		dev_err(blk->dev, "too many logical partitions\n");
+		goto out;
+	}
+
 out:
 	free(buf);
 	return;
-- 
2.47.3