feat: Limit xorriso boot image extraction size (#2019)

src/image.sh

@@ -524,6 +524,13 @@ detectLegacy() {
 
   [[ "${PLATFORM,,}" == "x64" ]] || return 1
 
+  marker=$(find "$dir" -maxdepth 1 -type d -iname 'ia64' -print -quit) || return 1
+
+  if [ -n "$marker" ]; then
+    error "Windows IA-64 (Itanium) images are not supported by this container!"
+    return 1
+  fi
+
   marker=$(find "$dir" -maxdepth 1 -type d -iname WIN95 -print -quit) || return 1
 
   if [ -n "$marker" ]; then
@@ -612,7 +619,8 @@ detectLegacy() {
       -iname WIN51AD -o \
       -iname WIN51AS -o \
       -iname WIN51MA -o \
-      -iname WIN51MD \
+      -iname WIN51MD -o \
+      -iname WIN51MP \
     \) \
     -print -quit) || return 1
 
@@ -1110,6 +1118,7 @@ extractBootImage() {
   local rc size offset image=""
   local msg="using legacy extraction..."
   local expected_size=$((BOOT_LOAD_SIZE * 512))
+  local max_extract_size=$((64 * 1024 * 1024))
   local boot_info
   local -a images=()
 
@@ -1119,12 +1128,17 @@ extractBootImage() {
   rm -f "$dir/$ETFS" || return 1
   rm -rf "$tmp" || return 1
 
-  if LC_ALL=C xorriso \
+  if command -v prlimit >/dev/null 2>&1; then
+    LC_ALL=C prlimit \
+      "--fsize=$max_extract_size:$max_extract_size" \
+      xorriso \
         -no_rc \
         -osirrox on \
         -indev "$iso" \
-      -extract_boot_images "$tmp" >/dev/null 2>&1; then
+        -extract_boot_images "$tmp" >/dev/null 2>&1
+    rc=$?
 
+    if (( rc == 0 )); then
       mapfile -t images < <(
         find "$tmp" \
           -maxdepth 1 \
@@ -1159,9 +1173,10 @@ extractBootImage() {
         warn "No BIOS boot image was found, $msg"
       fi
 
-  else
+    elif (( rc == 153 )); then
-    rc=$?
+      info "The extracted BIOS boot image exceeded the size limit, $msg"
 
+    else
       if (( rc > 128 )); then
         rm -rf "$tmp" || true
         exit "$rc"
@@ -1170,6 +1185,10 @@ extractBootImage() {
       warn "Failed to extract the BIOS boot image, $msg"
     fi
 
+  else
+    warn "The prlimit utility is unavailable, $msg"
+  fi
+
   rm -rf "$tmp" || true
 
   if ! boot_info=$(isoinfo -d -i "$iso"); then