From nobody Mon Nov 11 14:09:06 2024 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4XnBHR0wxKz5bdC8; Mon, 11 Nov 2024 14:09:07 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R10" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4XnBHR0KyHz3ymc; Mon, 11 Nov 2024 14:09:07 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1731334147; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=m1G2Ck+JoM8lJJXPrV2luNJCyugq8MKGQD/wbcPiYu4=; b=i4AmEBhDjiGLs8f0EhJWNQSMKG47oxzial/FUYUL8Fi7e9E0MyrWpUQ9EBxObRAXBgX2yJ IbUt9/6ct6kxkXmJanon6YUlrHyOhnxxLNvq5gEmAa+0zYuilRIbfsQMciUl4S3+mITE9j M9f7tcC1jHd7HaltMwo28EEBaLyZ5lul+Gxhg/Y1VVfO2lmb+GSlBVMfQ0djz0hSg2AVza iP5nsiq/q2MCVaMmHaSe1q0OdS49dg/VOHx2Tx83fXkyjUEMLwMUVpB8/79tC5lBC4/H9N rngLyl3weWxPKIy1uhbjKiZ7XeB59Q4XZl39ho57RRPzqNKu802e+0hcXrSo5A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1731334147; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=m1G2Ck+JoM8lJJXPrV2luNJCyugq8MKGQD/wbcPiYu4=; b=EIuKsZ0DQpwSS8t9A5sgF2xUhgxdHMoexKhwXnrZ6RXBPLXUY4lAmaO4h5HXXWJNzXkmNu Wf3OCN1F06CAyOB0xa9+nZ85BQaU0BD9Upg/xjUAHY6vcghsSzzTRjdqrclDmdXuRH1eEJ 5bvLOWodbJeLRZXnGKpOFvAxEBHAA93o8jlUAaQ36Ttkoy2/voZAlcGMu0Mg269e3umZhA xpxKnZHG4G0Qp53dpRT/QDm/rYbWfaiu2FoT8tNFiZnGvSGecRauJBMXuri562OiDKj4eB Pp+JYZOtMmWomQ0KkeDF4j5m1nTVRDTdfZrSSKl+z13zVjyHQKRGYDxUlnAAyg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1731334147; a=rsa-sha256; cv=none; b=LXv2mJpwv/F6b3i+s55UgDOtzhelaodnImHiPhYjccilP8nfu2z9tIaZWsvgy8I7Mldptk DnC+X7XSpleF1UcVYGNjdvtpNpstsgKxaMaQxlTBsu9gzgRzyNAvUqNLB2q4JCQUqEtfqK Udyn/Hu6/OFnraaLHPJNEt/7/hddFH14qlwSH1AF6bx3UeUVO9lrxEOsny/kGIkCw/nNZP 4r0rZq1+Mp62pwLtEIWPk0/uyrU+CzXhYtt5D/UsAl8IZmrWhfxk2Py9KRct7Erf9EaSr1 cOr2Ec0Ay+58Y3A+i8MXH2aJB4xLnt8LvrhtRIh9+ZsuiBb6173Ja0XN8EEEXw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4XnBHQ6hklzTDv; Mon, 11 Nov 2024 14:09:06 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 4ABE965J091956; Mon, 11 Nov 2024 14:09:06 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 4ABE96la091953; Mon, 11 Nov 2024 14:09:06 GMT (envelope-from git) Date: Mon, 11 Nov 2024 14:09:06 GMT Message-Id: <202411111409.4ABE96la091953@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: de03af6da759 - stable/14 - fstyp: Fix some memory safety bugs List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: de03af6da75990e56c45aea2c7eb53a06705b4c1 Auto-Submitted: auto-generated The branch stable/14 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=de03af6da75990e56c45aea2c7eb53a06705b4c1 commit de03af6da75990e56c45aea2c7eb53a06705b4c1 Author: Mark Johnston AuthorDate: 2024-10-28 13:51:58 +0000 Commit: Mark Johnston CommitDate: 2024-11-11 14:01:16 +0000 fstyp: Fix some memory safety bugs In the hammer2 label reader, make sure to check for a NULL return from read_buf(). In the NTFS label reader, - Avoid an infinite loop if a record length is 0. - Avoid walking past the end of the buffer. - When a label is found, avoid reading past the end of the buffer. PR: 278281 Reviewed by: emaste MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D47292 (cherry picked from commit 878ede1a0d0f10f851b2bc54be1e28f512bfc016) --- usr.sbin/fstyp/hammer2.c | 2 ++ usr.sbin/fstyp/ntfs.c | 36 ++++++++++++++++++++++++------------ 2 files changed, 26 insertions(+), 12 deletions(-) diff --git a/usr.sbin/fstyp/hammer2.c b/usr.sbin/fstyp/hammer2.c index e0c036c7442a..aeb29762fb6b 100644 --- a/usr.sbin/fstyp/hammer2.c +++ b/usr.sbin/fstyp/hammer2.c @@ -220,6 +220,8 @@ read_label(FILE *fp, char *label, size_t size) broot.data_off = (i * HAMMER2_ZONE_BYTES64) | HAMMER2_PBUFRADIX; vols[i] = read_buf(fp, broot.data_off & ~HAMMER2_OFF_MASK_RADIX, sizeof(*vols[i])); + if (vols[i] == NULL) + errx(1, "failed to read volume header"); broot.mirror_tid = vols[i]->voldata.mirror_tid; if (best_i < 0 || best.mirror_tid < broot.mirror_tid) { best_i = i; diff --git a/usr.sbin/fstyp/ntfs.c b/usr.sbin/fstyp/ntfs.c index a3457c285edc..be8095d5ee27 100644 --- a/usr.sbin/fstyp/ntfs.c +++ b/usr.sbin/fstyp/ntfs.c @@ -137,9 +137,8 @@ fstyp_ntfs(FILE *fp, char *label, size_t size) struct ntfs_filerec *fr; struct ntfs_attr *atr; off_t voloff; - char *ap; int8_t mftrecsz; - int recsize; + size_t recsize; #endif /* WITH_ICONV */ filerecp = NULL; @@ -152,7 +151,8 @@ fstyp_ntfs(FILE *fp, char *label, size_t size) goto ok; mftrecsz = bf->bf_mftrecsz; - recsize = (mftrecsz > 0) ? (mftrecsz * bf->bf_bps * bf->bf_spc) : (1 << -mftrecsz); + recsize = (mftrecsz > 0) ? + (mftrecsz * bf->bf_bps * bf->bf_spc) : (1 << -mftrecsz); voloff = bf->bf_mftcn * bf->bf_spc * bf->bf_bps + recsize * NTFS_VOLUMEINO; @@ -165,16 +165,28 @@ fstyp_ntfs(FILE *fp, char *label, size_t size) if (fr->fr_hdrmagic != NTFS_FILEMAGIC) goto fail; - for (ap = filerecp + fr->fr_attroff; - atr = (struct ntfs_attr *)ap, (int)atr->a_type != -1; - ap += atr->reclen) { - if (atr->a_type != NTFS_A_VOLUMENAME) - continue; - - convert_label(ap + atr->a_dataoff, - atr->a_datalen, label, size); - break; + for (size_t ioff = fr->fr_attroff; + ioff + sizeof(struct ntfs_attr) < recsize; + ioff += atr->reclen) { + atr = (struct ntfs_attr *)(filerecp + ioff); + if ((int)atr->a_type == -1) + goto ok; + if (atr->a_type == NTFS_A_VOLUMENAME) { + if ((size_t)atr->a_dataoff + atr->a_datalen > recsize) { + warnx("ntfs: Volume name attribute overflow"); + goto fail; + } + convert_label(filerecp + ioff + atr->a_dataoff, + atr->a_datalen, label, size); + goto ok; + } + if (atr->reclen == 0) { + warnx("ntfs: Invalid attribute record length"); + goto fail; + } } + warnx("ntfs: Volume name not found"); + goto fail; ok: #else