cd9660: Add various length checks when parsing RRIP extensions

[jhb]

Summary

Pass the length of a RockRidge attribute to the handler functions and
validate that length in each handler. If a parsing error is detected,
abort the entire parsing pass.

[jhb]

While the previous patch in this stack fixes a reproducer from Robert, this followup patch is intended as additional robustness. With both of these I was able to still mount a FreeBSD install CD and all of the attributes reported by find /mnt -ls were the same before and after the patches.

[des]

sys/fs/cd9660/cd9660_rrip.c

146–155

why is this not the loop initialization?

[emaste]

sys/fs/cd9660/cd9660_rrip.c

516–519

Ought to have the check before p->len_id above

[jhb]

sys/fs/cd9660/cd9660_rrip.c

146–155

Because it isn't the thing being iterated (pcomp) which would be the normal thing to set in the initializer. This is more like a TAILQ_FOREACH_SAFE(). The assignment here is more to pacify the compiler, but it isn't needed as the loop body always initializes pcompn before it can be used in the last clause. I haven't actually tried building without this assignment, perhaps modern compilers are smart enough to not warn?

516–519

Oops, yes.

[des]

modulo fix for the issue @emaste raised

[jhb]

Fixups