diff options
| author | Haithem Rahmani <[email protected]> | 2025-11-20 16:01:44 +0100 |
|---|---|---|
| committer | Haithem Rahmani <[email protected]> | 2025-11-20 18:14:06 +0100 |
| commit | d562e7a0a6d29db105d5301edc34df6b63a6ba87 (patch) | |
| tree | dc8bc170035fab9cd7b063bc8b02d512fcfa7644 /docs/USBX_Host_Stack_User_Guide.docx | |
| parent | cfdd55c48a2f44afa55cdb198fe65ddb0c8565ba (diff) | |
fix (host/storage): prevent stack overflow from infinite partition recursion
- Add a partition entry counter (ux_host_class_storage_mounted_partitions_count)
and a configurable maximum (UX_HOST_CLASS_STORAGE_MAX_PARTITIONS_COUNT) to limit
the number of partition entries processed during mounting.
- Counter is incremented for every partition entry, and checked both before and during the partition parsing loop.
- If the limit is exceeded, the function aborts and returns UX_HOST_CLASS_STORAGE_ERROR_MEDIA_NOT_READ.
- This prevents stack overflow and infinite recursion in case of malformed or cyclic MBR/EBR partition tables.
- Default partition entry limit set to 8 by default for safety and compatibility with typical devices.
Fixes CVE-2025-55095
Signed-off-by: Haithem Rahmani <[email protected]>
Diffstat (limited to 'docs/USBX_Host_Stack_User_Guide.docx')
0 files changed, 0 insertions, 0 deletions
