Date: Thu, 29 Jul 2021 18:15:36 +0000 From: bugzilla-noreply@freebsd.org To: bugs@FreeBSD.org Subject: [Bug 257491] fsck_msdosfs can crash if input is bad Message-ID: <bug-257491-227@https.bugs.freebsd.org/bugzilla/>
next in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D257491 Bug ID: 257491 Summary: fsck_msdosfs can crash if input is bad Product: Base System Version: 13.0-RELEASE Hardware: amd64 OS: Any Status: New Severity: Affects Only Me Priority: --- Component: bin Assignee: bugs@FreeBSD.org Reporter: rtm@lcs.mit.edu Created attachment 226783 --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=3D226783&action= =3Dedit A FAT12 file system image that crashes fsck_msdosfs I've attached a FAT12 image, fat.dat, that crashes fsck_msdosfs: % fsck_msdosfs /tmp/fat.dat ** /tmp/fat.dat ** Phase 1 - Read FAT and checking connectivity Bus error % uname -a FreeBSD xxx 13.0-RELEASE-p3 FreeBSD 13.0-RELEASE-p3 #0: Tue Jun 29 19:46:20= UTC 2021=20=20=20=20 root@amd64-builder.daemonology.net:/usr/obj/usr/src/amd64.amd64/sys/GENERIC= =20 amd64 The problem seems to be that fat.dat has a FATsecs and bpbBytesPerSec that multiply to more than the size of fat.dat; fsck_msdosfs calls mmap() with that huge offset; mmap() returns a pointer (not MAP_FAILED); fsck_msdosfs uses that pointer, but there's nothing there but a bus error. --=20 You are receiving this mail because: You are the assignee for the bug.=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-257491-227>