harden: bound directory recursion depth when parsing an index

_xml_parse_dirtree recurses once per directory level, and the index
reader sets XML_PARSE_HUGE, which removes libxml2's own nesting limit.
A crafted index with deeply nested <directory> elements could recurse
until the C stack overflows while mounting an untrusted cartridge.

Add a depth bound (a stack-safety guard, not an LTFS format limit; the
format defines no maximum depth) set well above any tree that fits in a
conventional PATH_MAX, so it cannot reject a volume produced from a real
filesystem. Introduces LTFS_XML_DEEP_NESTING (5051).

Author: matejk

messages/internal_error/root.txt

@@ -309,6 +309,7 @@ root:table {
 		I5048E:string{ "Unexpected partition map in a label." }
 		I5049E:string{ "Unexpected blocksize in a label." }
 		I5050E:string{ "Unexpected compression in a label." }
+		I5051E:string{ "Directory nesting in the index is too deep." }
 
 		// Special error codes
 		I9997E:string{ "Child process error (ltfsck/mkltfs): %s (%d)." }

messages/libltfs/root.txt

@@ -836,6 +836,7 @@ v
 		17292I:string { "Current position is (%llu, %llu), Error position is (%llu, %llu)." }
 	 	17293E:string { "Position mismatch. Cached tape position = %llu. Current tape position = %llu." }
 	 	17294I:string { "Continue signal (%d) received" }
+		17295E:string { "XML parser: directory nesting is too deep (limit %d)." }
 
 		// For Debug 19999I:string { "%s %s %d." }
 

src/libltfs/arch/errormap.c

@@ -342,6 +342,7 @@ static struct error_map fuse_error_list[] = {
 	{ LTFS_XML_WRONG_PART_MAP,       "I5048E", EINVAL},
 	{ LTFS_XML_WRONG_BLOCKSIZE,      "I5049E", EINVAL},
 	{ LTFS_XML_WRONG_COMP,           "I5050E", EINVAL},
+	{ LTFS_XML_DEEP_NESTING,         "I5051E", EINVAL},
 	{ EDEV_NO_SENSE,                 "D0000E", EIO},
 	{ EDEV_OVERRUN,                  "D0002E", EIO},
 	{ EDEV_UNDERRUN,                 "D0003E", ENODATA},

src/libltfs/ltfs_error.h

@@ -317,6 +317,7 @@
 #define LTFS_XML_WRONG_PART_MAP   5048  /* Unexpected partition map in a label */
 #define LTFS_XML_WRONG_BLOCKSIZE  5049  /* Unexpected blocksize in a label */
 #define LTFS_XML_WRONG_COMP       5050  /* Unexpected compression in a label */
+#define LTFS_XML_DEEP_NESTING     5051  /* Directory nesting in the index is too deep */
 
 #define LTFS_ERR_MAX              19999
 

src/libltfs/xml_reader_libltfs.c

@@ -1192,11 +1192,21 @@ static int _xml_parse_file(xmlTextReaderPtr reader, struct ltfs_index *idx, stru
  * Parse a dir into the given directory.
  */
 
+/* Guard against C-stack exhaustion while parsing the directory tree:
+ * _xml_parse_dirtree recurses once per nesting level and XML_PARSE_HUGE
+ * removes libxml2's own nesting limit, so a crafted index could otherwise
+ * recurse until the stack overflows. This is a stack-safety bound, not an
+ * LTFS format limit (the format defines no maximum depth); it is set far
+ * above any tree that fits in a conventional PATH_MAX, so it cannot reject
+ * a volume produced from a real filesystem. */
+#define XML_MAX_DIRTREE_DEPTH 1024
+
 static int _xml_parse_dirtree(xmlTextReaderPtr reader, struct dentry *parent,
 							  struct ltfs_index *idx, struct ltfs_volume *vol,
-							  struct name_list *dirname); /* Forward reference */
+							  struct name_list *dirname, int depth); /* Forward reference */
 
-static int _xml_parse_dir_contents(xmlTextReaderPtr reader, struct dentry *dir, struct ltfs_index *idx)
+static int _xml_parse_dir_contents(xmlTextReaderPtr reader, struct dentry *dir,
+								   struct ltfs_index *idx, int depth)
 {
 	struct name_list *list = NULL, *entry_name = NULL;
 	CHECK_ARG_NULL(dir, -LTFS_NULL_ARG);
@@ -1228,7 +1238,7 @@ static int _xml_parse_dir_contents(xmlTextReaderPtr reader, struct dentry *dir,
 				ltfsmsg(LTFS_ERR, 10001E, "_xml_parse_dir_contents: dir");
 				return -LTFS_NO_MEMORY;
 			}
-			ret = _xml_parse_dirtree(reader, dir, idx, dir->vol, entry_name);
+			ret = _xml_parse_dirtree(reader, dir, idx, dir->vol, entry_name, depth + 1);
 			if (ret < 0) {
 				free(entry_name);
 				return ret;
@@ -1285,14 +1295,19 @@ static int _xml_parse_dir_contents(xmlTextReaderPtr reader, struct dentry *dir,
  */
 static int _xml_parse_dirtree(xmlTextReaderPtr reader, struct dentry *parent,
 							  struct ltfs_index *idx, struct ltfs_volume *vol,
-							  struct name_list *dirname)
+							  struct name_list *dirname, int depth)
 {
 	unsigned long long value_int;
 	struct dentry *dir;
 
 	declare_parser_vars("directory");
 	declare_tracking_arrays(9, 1);
 
+	if (depth > XML_MAX_DIRTREE_DEPTH) {
+		ltfsmsg(LTFS_ERR, 17295E, XML_MAX_DIRTREE_DEPTH);
+		return -LTFS_XML_DEEP_NESTING;
+	}
+
 	if (! parent && idx->root) {
 		dir = idx->root;
 		dir->vol = vol;
@@ -1407,7 +1422,7 @@ static int _xml_parse_dirtree(xmlTextReaderPtr reader, struct dentry *parent,
 			check_required_tag(6);
 			check_empty();
 			if (empty == 0) {
-				ret = _xml_parse_dir_contents(reader, dir, idx);
+				ret = _xml_parse_dir_contents(reader, dir, idx, depth);
 				if (ret < 0)
 					return ret;
 			}
@@ -1598,7 +1613,7 @@ static int _xml_parse_schema(xmlTextReaderPtr reader, struct ltfs_index *idx, st
 		} else if (! strcmp(name, "directory")) {
 			check_required_tag(6);
 			assert_not_empty();
-			ret = _xml_parse_dirtree(reader, NULL, idx, vol, NULL);
+			ret = _xml_parse_dirtree(reader, NULL, idx, vol, NULL, 0);
 			if (ret < 0)
 				return ret;