From nobody Thu Sep 03 07:04:13 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hb9ZB33ryz6qm9V for ; Thu, 03 Sep 2026 07:04:18 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hb9ZB213Xz3N8N for ; Thu, 03 Sep 2026 07:04:18 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1788419058; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=kEAMKoUPxJwoi0LyyXh0L6eSiaQmKN8s7DM9sbi0AbQ=; b=CWnOmxTbUojqcUWc1gEEuN5XS47BH7c/4JabbLxe+BPzvOW255VQFw/zFVN/Dwd2tLAyO0 xmPv2TL3v6xQWi8qrYKgJnV7dkKApmcK9kx9BW4DZVNuCSYz0TDgVxi+JNeWZDEx2qisY2 RTffmI/S7M0eDKD13SUydfy7fqBfV0XZ/y5QXkQghvtJxlkWIcKL2bKV3lht2jtVijVYbI Ch1nPeRimzFT8OkAwaCxQSdrgGr7Gj0EJOQZ+cikI1KM4o4H/e44y9/RwvPAfutSOpMlua ilyuZD6/0NxlLmizM/DpblO+pH7a+8a7nVt8Zm+BtbEY8v3xwr0L1B/LnePF/g== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1788419058; a=rsa-sha256; cv=none; b=lY99aJObsMlu4odXlvr/vpl3636fdh+/A1RYhJYD8ZITeh8QYPH4ioZSlPtpWjO+bPMCBd NBXWNIB2wAbwYO0dz2sZnk3Ok/OhGsbw2AKLFK1qa6BvLJoOtl53MuLzeR5DJ/Z10lK4/3 bnaO3he4dfjmS2sVbHNF+/rNH7nOaul6XWeSzMq9Xp27hg+epmI71x99YDqDZY7ZCrl7vS AEKx5kSCFtMTZjhAfk4C2NnmjdP494i3BOXvyI6+PXOhWOaYnWqMKoH1T6RvUqOjxnH1qI kRpEbtfu9mhxB0Y+M5oiqlolN3A0fKqn2yUvvaX30ExMtV4Kv+Ss3bmX0oIlfA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1788419058; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=kEAMKoUPxJwoi0LyyXh0L6eSiaQmKN8s7DM9sbi0AbQ=; b=pm9fJDy3a7SQOLgMYEIaH9LF3i05KS1ALrbmwWcLQ9nLIP9BG3Mh6baiF2NPCVkoo8NFlI YPlTAlC5XRsGdNDyCJKSRtwYcnu6Sanw8F1YQ1PR7ykpVNruAbuzWILwRqYM29155q9C7D GStXf0vGt5NnRaEhoTVJREINIyUJP1fvlCWcU2I0akTMuVurlfFimH5jGNR1fzqewo0UqR pGN/IOa0esPtDgNxrrc/dKAkVtRpv+Zkld1YQXvDj/vrR7gcIK1zD27lrrq0od43w04zbP NE6KYBh02oXWFUO2eSgoBKCx/6gl1nNfQyvXPH1coi9Pxss9Xpt5V5rr4l76zA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hb9ZB0f0wz1HsK for ; Thu, 03 Sep 2026 07:04:18 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 1d23b by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Thu, 03 Sep 2026 07:04:13 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Cc: Chris Suter From: Xin LI Subject: git: 18094609d301 - main - fsck_msdosfs: avoid signed integer overflow in readboot() List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: delphij X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 18094609d301540526d3d57e92705bc989d29986 Auto-Submitted: auto-generated Date: Thu, 03 Sep 2026 07:04:13 +0000 Message-Id: <6a991bed.1d23b.1b1e7c22@gitrepo.freebsd.org> The branch main has been updated by delphij: URL: https://cgit.FreeBSD.org/src/commit/?id=18094609d301540526d3d57e92705bc989d29986 commit 18094609d301540526d3d57e92705bc989d29986 Author: Chris Suter AuthorDate: 2026-09-03 05:23:46 +0000 Commit: Xin LI CommitDate: 2026-09-03 06:51:19 +0000 fsck_msdosfs: avoid signed integer overflow in readboot() readboot() decoded the 32-bit little-endian BIOS Parameter Block and FSInfo fields by shifting the individual bytes of a u_char array into place. The u_char operands are promoted to signed int, so shifting a most significant byte of 0x80 or greater left by 24 overflows int, which is undefined behavior. Use le32dec() from instead, which is both well defined and easier to read. No functional change intended. MFC after: 1 week Pull Request: https://github.com/freebsd/freebsd-src/pull/2350 --- sbin/fsck_msdosfs/boot.c | 21 +++++++-------------- 1 file changed, 7 insertions(+), 14 deletions(-) diff --git a/sbin/fsck_msdosfs/boot.c b/sbin/fsck_msdosfs/boot.c index f91609470ad7..ec59c3e02dde 100644 --- a/sbin/fsck_msdosfs/boot.c +++ b/sbin/fsck_msdosfs/boot.c @@ -32,6 +32,7 @@ __RCSID("$NetBSD: boot.c,v 1.22 2020/01/11 16:29:07 christos Exp $"); #endif /* not lint */ #include +#include #include #include @@ -127,12 +128,10 @@ readboot(int dosfs, struct bootblock *boot) boot->bpbHeads = block[26] + (block[27] << 8); /* Hidden sectors: ignored */ - boot->bpbHiddenSecs = block[28] + (block[29] << 8) + - (block[30] << 16) + (block[31] << 24); + boot->bpbHiddenSecs = le32dec(&block[28]); /* Total sectors (32 bits) */ - boot->bpbHugeSectors = block[32] + (block[33] << 8) + - (block[34] << 16) + (block[35] << 24); + boot->bpbHugeSectors = le32dec(&block[32]); if (boot->bpbHugeSectors == 0) { if (boot->flags & FAT32) { pfatal("FAT32 with sector count of zero"); @@ -158,8 +157,7 @@ readboot(int dosfs, struct bootblock *boot) } /* 32-bit count of sectors per FAT */ - boot->FATsecs = block[36] + (block[37] << 8) - + (block[38] << 16) + (block[39] << 24); + boot->FATsecs = le32dec(&block[36]); if (block[40] & 0x80) boot->ValidFat = block[40] & 0x0f; @@ -176,8 +174,7 @@ readboot(int dosfs, struct bootblock *boot) * * Should be 2 but do not require it. */ - boot->bpbRootClust = block[44] + (block[45] << 8) - + (block[46] << 16) + (block[47] << 24); + boot->bpbRootClust = le32dec(&block[44]); /* Sector number of the FSInfo structure, usually 1 */ boot->bpbFSInfo = block[48] + (block[49] << 8); @@ -236,12 +233,8 @@ readboot(int dosfs, struct bootblock *boot) boot->bpbFSInfo = 0; } else { /* We appear to have a valid FSInfo block, decode */ - boot->FSFree = fsinfo[0x1e8] + (fsinfo[0x1e9] << 8) - + (fsinfo[0x1ea] << 16) - + (fsinfo[0x1eb] << 24); - boot->FSNext = fsinfo[0x1ec] + (fsinfo[0x1ed] << 8) - + (fsinfo[0x1ee] << 16) - + (fsinfo[0x1ef] << 24); + boot->FSFree = le32dec(&fsinfo[0x1e8]); + boot->FSNext = le32dec(&fsinfo[0x1ec]); } } else { /* !FAT32: FAT12/FAT16 */