From owner-svn-src-stable-11@freebsd.org Thu Oct 1 03:10:43 2020 Return-Path: Delivered-To: svn-src-stable-11@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 91AF33F068B; Thu, 1 Oct 2020 03:10:43 +0000 (UTC) (envelope-from delphij@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4C1ymz3PDMz47kR; Thu, 1 Oct 2020 03:10:43 +0000 (UTC) (envelope-from delphij@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 5825CA346; Thu, 1 Oct 2020 03:10:43 +0000 (UTC) (envelope-from delphij@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id 0913Ahbc025944; Thu, 1 Oct 2020 03:10:43 GMT (envelope-from delphij@FreeBSD.org) Received: (from delphij@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id 0913AhUh025943; Thu, 1 Oct 2020 03:10:43 GMT (envelope-from delphij@FreeBSD.org) Message-Id: <202010010310.0913AhUh025943@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: delphij set sender to delphij@FreeBSD.org using -f From: Xin LI Date: Thu, 1 Oct 2020 03:10:43 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-11@freebsd.org Subject: svn commit: r366306 - stable/11/sbin/fsck_msdosfs X-SVN-Group: stable-11 X-SVN-Commit-Author: delphij X-SVN-Commit-Paths: stable/11/sbin/fsck_msdosfs X-SVN-Commit-Revision: 366306 X-SVN-Commit-Repository: base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-stable-11@freebsd.org X-Mailman-Version: 2.1.33 Precedence: list List-Id: SVN commit messages for only the 11-stable src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Oct 2020 03:10:43 -0000 Author: delphij Date: Thu Oct 1 03:10:42 2020 New Revision: 366306 URL: https://svnweb.freebsd.org/changeset/base/366306 Log: MFC r366064, r366065, r366215: sbin/fsck_msdosfs: Fix an integer overflow on 32-bit platforms Modified: stable/11/sbin/fsck_msdosfs/dir.c Directory Properties: stable/11/ (props changed) Modified: stable/11/sbin/fsck_msdosfs/dir.c ============================================================================== --- stable/11/sbin/fsck_msdosfs/dir.c Thu Oct 1 03:08:23 2020 (r366305) +++ stable/11/sbin/fsck_msdosfs/dir.c Thu Oct 1 03:10:42 2020 (r366306) @@ -388,7 +388,8 @@ static int checksize(struct fat_descriptor *fat, u_char *p, struct dosDirEntry *dir) { int ret = FSOK; - size_t physicalSize; + size_t chainsize; + u_int64_t physicalSize; struct bootblock *boot; boot = fat_get_boot(fat); @@ -401,9 +402,9 @@ checksize(struct fat_descriptor *fat, u_char *p, struc } else { if (!fat_is_valid_cl(fat, dir->head)) return FSERROR; - ret = checkchain(fat, dir->head, &physicalSize); + ret = checkchain(fat, dir->head, &chainsize); /* - * Upon return, physicalSize would hold the chain length + * Upon return, chainsize would hold the chain length * that checkchain() was able to validate, but if the user * refused the proposed repair, it would be unsafe to * proceed with directory entry fix, so bail out in that @@ -412,11 +413,17 @@ checksize(struct fat_descriptor *fat, u_char *p, struc if (ret == FSERROR) { return (FSERROR); } - physicalSize *= boot->ClusterSize; + /* + * The maximum file size on FAT32 is 4GiB - 1, which + * will occupy a cluster chain of exactly 4GiB in + * size. On 32-bit platforms, since size_t is 32-bit, + * it would wrap back to 0. + */ + physicalSize = (u_int64_t)chainsize * boot->ClusterSize; } if (physicalSize < dir->size) { - pwarn("size of %s is %u, should at most be %zu\n", - fullpath(dir), dir->size, physicalSize); + pwarn("size of %s is %u, should at most be %ju\n", + fullpath(dir), dir->size, (uintmax_t)physicalSize); if (ask(1, "Truncate")) { dir->size = physicalSize; p[28] = (u_char)physicalSize;