[Bug 258930] sysutils/fusefs-ntfs: corrupt file system can cause seg fault in ntfs_attr_record_resize()

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=258930

            Bug ID: 258930
           Summary: sysutils/fusefs-ntfs: corrupt file system can cause
                    seg fault in ntfs_attr_record_resize()
           Product: Ports & Packages
           Version: Latest
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: Individual Port(s)
          Assignee: ports-bugs@FreeBSD.org
          Reporter: rtm@lcs.mit.edu
                CC: freebsd@dussan.org
             Flags: maintainer-feedback?(freebsd@dussan.org)
                CC: freebsd@dussan.org

Created attachment 228440
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=228440&action=edit
sysutils/fusefs-ntfs: this disk image causes a seg fault in
ntfs_attr_record_resize()

The attached corrupt NTFS disk image causes this call to memmove() in
ntfs_attr_record_resize() to crash:

                memmove((u8 *)a + new_size, (u8 *)a + attr_size,
                        old_size - ((u8 *)a - (u8 *)m) - attr_size);

I believe problem is that the third argument is negative -- or actually
huge, since size_t is unsigned.

% gunzip ntx7.img.gz 
% sudo mdconfig -f ntx7.img 
md0
% sudo ntfs-3g /dev/md0p1 /mnt
Did not find any restart pages in $LogFile and it was not empty.
The file system wasn't safely closed on Windows. Fixing.
ntfs_attr_find: Corrupt inode (2): Input/output error
Non-positive free clusters (0)!
Non-positive free clusters (0)!
Segmentation fault
% ntfs-3g --version
ntfs-3g 2017.3.23 external FUSE 29
% uname -a
FreeBSD xxx 13.0-RELEASE-p4 FreeBSD 13.0-RELEASE-p4 #0: Tue Aug 24 07:33:27 UTC
2021    
root@amd64-builder.daemonology.net:/usr/obj/usr/src/amd64.amd64/sys/GENERIC 
amd64

The backtrace:

#0  0x00000000402a725a in memmove () from /lib/libc.so.7
#1  0x00000000400b0d56 in ntfs_attr_record_resize (m=0x409d6400, a=0x409d6508, 
    new_size=80) at attrib.c:4536
#2  0x00000000400b31f8 in ntfs_attr_update_mapping_pairs_i (na=0x40810500, 
    from_vcn=0, holes=<optimized out>) at attrib.c:5795
#3  0x00000000400af714 in ntfs_attr_update_mapping_pairs (na=0x409d6558, 
    from_vcn=1107296256) at attrib.c:6003
#4  0x00000000400aed3a in ntfs_attr_pwrite_i (na=0x40810500, pos=0, count=0, 
    b=<optimized out>) at attrib.c:2249
#5  0x00000000400ae360 in ntfs_attr_pwrite (na=0x40810500, pos=0, count=8192, 
    b=0x3fffffc758) at attrib.c:2351
#6  0x00000000400c68a8 in ntfs_empty_logfile (na=0x40810500) at logfile.c:731
#7  0x00000000400d60e2 in ntfs_logfile_reset (vol=<optimized out>)
    at volume.c:1673
#8  0x00000000400d5ed6 in ntfs_device_mount (dev=<optimized out>, 
    flags=<optimized out>) at volume.c:1268
#9  0x00000000400d6478 in ntfs_mount (name=<optimized out>, flags=436207616)
    at volume.c:1386

-- 
You are receiving this mail because:
You are the assignee for the bug.