[Bug 296853] cd9660_rrip_offset() does not initialize analyze.outlen

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296853

            Bug ID: 296853
           Summary: cd9660_rrip_offset() does not initialize
                    analyze.outlen
           Product: Base System
           Version: CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Some People
          Priority: ---
         Component: kern
          Assignee: bugs@FreeBSD.org
          Reporter: rtm@lcs.mit.edu

Created attachment 272931
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=272931&action=edit
try to trigger a bug in cd9660_rrip_offset()

cd9660_rrip_offset():

        ISO_RRIP_ANALYZE analyze;
        ...;
        analyze.imp = imp;
        analyze.fields = ISO_SUSP_EXTREF;
        ret = cd9660_rrip_loop(isodir, &analyze, rrip_table_extref);

But cd9660_rrip_loop() can execute:

                               if (ana->error) {
                                        *ana->outlen = 0;

So the *ana->outlen may try to write through the uninitialized
pointer in ana->outlen.

cd9660_rrip_analyze() also doesn't initialize analyze.outlen.

I've attached a demo iso image, though it is not reliable since it 
depends on the actual value in analyze.outlen:

# uname -a
FreeBSD  16.0-CURRENT FreeBSD 16.0-CURRENT #31 main-n251029-32a9224d6dea-dirty:
Fri Jul 17 07:12:52 EDT 2026    
rtm@xxx:/usr/obj/usr/rtm/symbsd/src/riscv.riscv64/sys/RTM riscv
# mdconfig -f cd1c.iso
# mount_cd9660 /dev/md0 /mnt
...
panic: Fatal page fault at 0xffffffc0004491e6: 0x1
panic() at panic+0x26
page_fault_handler() at page_fault_handler+0x246
do_trap_supervisor() at do_trap_supervisor+0x6e
cpu_exception_handler_supervisor() at cpu_exception_handler_supervisor+0x74
--- exception 15, tval = 0x1
cd9660_rrip_loop() at cd9660_rrip_loop+0x1c4
cd9660_rrip_offset() at cd9660_rrip_offset+0x86
iso_mountfs() at iso_mountfs+0x87a
cd9660_mount() at cd9660_mount+0x202
vfs_domount_first() at vfs_domount_first+0x25e
vfs_domount() at vfs_domount+0x292
vfs_donmount() at vfs_donmount+0x866
sys_nmount() at sys_nmount+0x64
do_trap_user() at do_trap_user+0x1fe
cpu_exception_handler_user() at cpu_exception_handler_user+0x72
--- syscall (378, FreeBSD ELF64, nmount)

-- 
You are receiving this mail because:
You are the assignee for the bug.