feat: Limit xorriso boot image extraction size (#2019)

src/image.sh

@@ -524,6 +524,13 @@ detectLegacy() {
 
   [[ "${PLATFORM,,}" == "x64" ]] || return 1
 
+  marker=$(find "$dir" -maxdepth 1 -type d -iname 'ia64' -print -quit) || return 1
+
+  if [ -n "$marker" ]; then
+    error "Windows IA-64 (Itanium) images are not supported by this container!"
+    return 1
+  fi
+
   marker=$(find "$dir" -maxdepth 1 -type d -iname WIN95 -print -quit) || return 1
 
   if [ -n "$marker" ]; then
@@ -612,7 +619,8 @@ detectLegacy() {
       -iname WIN51AD -o \
       -iname WIN51AS -o \
       -iname WIN51MA -o \
-      -iname WIN51MD \
+      -iname WIN51MD -o \
+      -iname WIN51MP \
     \) \
     -print -quit) || return 1
 
@@ -1110,6 +1118,7 @@ extractBootImage() {
   local rc size offset image=""
   local msg="using legacy extraction..."
   local expected_size=$((BOOT_LOAD_SIZE * 512))
+  local max_extract_size=$((64 * 1024 * 1024))
   local boot_info
   local -a images=()
 
@@ -1119,55 +1128,65 @@ extractBootImage() {
   rm -f "$dir/$ETFS" || return 1
   rm -rf "$tmp" || return 1
 
-  if LC_ALL=C xorriso \
+  if command -v prlimit >/dev/null 2>&1; then
-      -no_rc \
+    LC_ALL=C prlimit \
-      -osirrox on \
+      "--fsize=$max_extract_size:$max_extract_size" \
-      -indev "$iso" \
+      xorriso \
-      -extract_boot_images "$tmp" >/dev/null 2>&1; then
+        -no_rc \
+        -osirrox on \
+        -indev "$iso" \
+        -extract_boot_images "$tmp" >/dev/null 2>&1
+    rc=$?
 
-    mapfile -t images < <(
+    if (( rc == 0 )); then
-      find "$tmp" \
+      mapfile -t images < <(
-        -maxdepth 1 \
+        find "$tmp" \
-        -type f \
+          -maxdepth 1 \
-        -name 'eltorito_img*_bios.img' \
+          -type f \
-        -print
+          -name 'eltorito_img*_bios.img' \
-    )
+          -print
+      )
 
-    if (( ${#images[@]} == 1 )); then
+      if (( ${#images[@]} == 1 )); then
-      image="${images[0]}"
+        image="${images[0]}"
 
-      if [ ! -s "$image" ]; then
+        if [ ! -s "$image" ]; then
-        warn "The extracted BIOS boot image is empty, $msg"
+          warn "The extracted BIOS boot image is empty, $msg"
-      elif ! size=$(stat -c%s "$image"); then
+        elif ! size=$(stat -c%s "$image"); then
-        warn "Failed to determine the BIOS boot image size, $msg"
+          warn "Failed to determine the BIOS boot image size, $msg"
-      elif (( size != expected_size )); then
+        elif (( size != expected_size )); then
-        info "The extracted BIOS boot image has an unexpected size, $msg"
+          info "The extracted BIOS boot image has an unexpected size, $msg"
-      else
+        else
-        if ! mv -f "$image" "$dir/$ETFS"; then
+          if ! mv -f "$image" "$dir/$ETFS"; then
-          rm -rf "$tmp" || true
+            rm -rf "$tmp" || true
-          error "Failed to save boot image from $desc ISO!"
+            error "Failed to save boot image from $desc ISO!"
-          return 1
+            return 1
+          fi
+
+          rm -rf "$tmp" || return 1
+          return 0
         fi
 
-        rm -rf "$tmp" || return 1
+      elif (( ${#images[@]} > 1 )); then
-        return 0
+        warn "Multiple BIOS boot images were found, $msg"
+      else
+        warn "No BIOS boot image was found, $msg"
       fi
 
-    elif (( ${#images[@]} > 1 )); then
+    elif (( rc == 153 )); then
-      warn "Multiple BIOS boot images were found, $msg"
+      info "The extracted BIOS boot image exceeded the size limit, $msg"
+
     else
-      warn "No BIOS boot image was found, $msg"
+      if (( rc > 128 )); then
+        rm -rf "$tmp" || true
+        exit "$rc"
+      fi
+
+      warn "Failed to extract the BIOS boot image, $msg"
     fi
 
   else
-    rc=$?
+    warn "The prlimit utility is unavailable, $msg"
-
-    if (( rc > 128 )); then
-      rm -rf "$tmp" || true
-      exit "$rc"
-    fi
-
-    warn "Failed to extract the BIOS boot image, $msg"
   fi
 
   rm -rf "$tmp" || true