[Bug 257491] fsck_msdosfs can crash if input is bad

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=257491

            Bug ID: 257491
           Summary: fsck_msdosfs can crash if input is bad
           Product: Base System
           Version: 13.0-RELEASE
          Hardware: amd64
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: bin
          Assignee: bugs@FreeBSD.org
          Reporter: rtm@lcs.mit.edu

Created attachment 226783
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=226783&action=edit
A FAT12 file system image that crashes fsck_msdosfs

I've attached a FAT12 image, fat.dat, that crashes fsck_msdosfs:

% fsck_msdosfs /tmp/fat.dat
** /tmp/fat.dat
** Phase 1 - Read FAT and checking connectivity
Bus error
% uname -a
FreeBSD xxx 13.0-RELEASE-p3 FreeBSD 13.0-RELEASE-p3 #0: Tue Jun 29 19:46:20 UTC
2021    
root@amd64-builder.daemonology.net:/usr/obj/usr/src/amd64.amd64/sys/GENERIC 
amd64

The problem seems to be that fat.dat has a FATsecs and bpbBytesPerSec
that multiply to more than the size of fat.dat; fsck_msdosfs calls mmap()
with that huge offset; mmap() returns a pointer (not MAP_FAILED);
fsck_msdosfs uses that pointer, but there's nothing there but a bus error.

-- 
You are receiving this mail because:
You are the assignee for the bug.