From nobody Mon Nov 11 14:10:41 2024 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4XnBKF43JRz5bd5M; Mon, 11 Nov 2024 14:10:41 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R10" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4XnBKF3dqdz41b7; Mon, 11 Nov 2024 14:10:41 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1731334241; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=pF8H12G2JQoTah5y1qNvDmuBRRSM9ZZhvfGs4oD9F3U=; b=ZeD6COjxkLjq5RKP/Usy0hO8x0H24jM3Es7U2Et+Wqfd5c4+uPKM/Wn56niLXYfQSWHKA3 zVllGLhttaFLOf6pMaoeqQXgcHKb5OYdR6ARKqLN0FofvARu6PVZ5S/dSJQOrRUH0ozF5x t9TZBh/i5rCUeU42GnTYsQxrBLLI1XVOb4mUhI3VO7w/uTPZE2UT3p2pRs91DJIEkeFk/m fF9WZJlOyKRkNx1wUc3qsuvtmeIuixnFJuRWXXGQC1eFAjKLclyepO1EVyvgRKlj6h5Gdv LTLpg8Bv9hTZgYEjLJfeGwQVnAAa7r6RdS6l4bQIpMr+0QBdem5kE6zSKSKHuA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1731334241; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=pF8H12G2JQoTah5y1qNvDmuBRRSM9ZZhvfGs4oD9F3U=; b=qD6Nrl7jA04lT4hpSDQnWh7KFAKO9qGTgddyy3TYEwDzQ5zVOoNDoDx8MSvzhD4H7X+uVT ZGC1SlCTYbd4K1dFJz+RnlC/sdkjeg0mIbZUyh2thoKhajfToFMZGczjKyjFAFptS/3u0+ q5PahHgVOoyLdiF2fnM3qHK8MvFDzSjioBpsm06XIWf784HiYQcK0Cqoudm4ho5IORmiwi 1xNo6KrLtvcWa2K1jfh3C5zTowFxvd11gtzBDhAICGDOtft62LvW3AzKygC5+PYstpbriY DsI1sG9gRw0hjuDYY5UK5Wx9OvwWmDcKO7nvZkmKqCNyZ7g+mbpTVwKuEGs95w== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1731334241; a=rsa-sha256; cv=none; b=qykPOFsVNhT2oNjF1D3oOcfcpciBmcMnfIcOAG8FJOCB9zOv4mzJy3KmmlyVqksFz/N2ZX b9lLTyI11gbHWOaCh0UXTAFy1nLEmjaruU4QfwiuZmANHratTWmVD10CZ/uX1nD8h+vkdg D3fHLLYlIKm1zco2bpzBjTTsGXNXZezYRV+u8D5QDHSk59h0WlZTlvHluIMkmUxcV4s/Zr 3l7nl7gKFCNc71G+n9MxnxeNYV4zUli5RwyObKUTQxREHMXRRCJthlq4QUu++jK/ps0OIh EZBfTG1fPmrGIdBrBSqWa7qJM92mQVUSNzDYnU2z7ilCR3b1w5rcksQRG4YIuA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4XnBKF36YFzTQl; Mon, 11 Nov 2024 14:10:41 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 4ABEAfNG001397; Mon, 11 Nov 2024 14:10:41 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 4ABEAf6Y001394; Mon, 11 Nov 2024 14:10:41 GMT (envelope-from git) Date: Mon, 11 Nov 2024 14:10:41 GMT Message-Id: <202411111410.4ABEAf6Y001394@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 75351a04884e - stable/13 - fstyp: Fix some memory safety bugs List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/13 X-Git-Reftype: branch X-Git-Commit: 75351a04884e7c79332f9c7a148424bf8cfa2c7f Auto-Submitted: auto-generated The branch stable/13 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=75351a04884e7c79332f9c7a148424bf8cfa2c7f commit 75351a04884e7c79332f9c7a148424bf8cfa2c7f Author: Mark Johnston AuthorDate: 2024-10-28 13:51:58 +0000 Commit: Mark Johnston CommitDate: 2024-11-11 14:01:23 +0000 fstyp: Fix some memory safety bugs In the hammer2 label reader, make sure to check for a NULL return from read_buf(). In the NTFS label reader, - Avoid an infinite loop if a record length is 0. - Avoid walking past the end of the buffer. - When a label is found, avoid reading past the end of the buffer. PR: 278281 Reviewed by: emaste MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D47292 (cherry picked from commit 878ede1a0d0f10f851b2bc54be1e28f512bfc016) --- usr.sbin/fstyp/hammer2.c | 2 ++ usr.sbin/fstyp/ntfs.c | 36 ++++++++++++++++++++++++------------ 2 files changed, 26 insertions(+), 12 deletions(-) diff --git a/usr.sbin/fstyp/hammer2.c b/usr.sbin/fstyp/hammer2.c index e0c036c7442a..aeb29762fb6b 100644 --- a/usr.sbin/fstyp/hammer2.c +++ b/usr.sbin/fstyp/hammer2.c @@ -220,6 +220,8 @@ read_label(FILE *fp, char *label, size_t size) broot.data_off = (i * HAMMER2_ZONE_BYTES64) | HAMMER2_PBUFRADIX; vols[i] = read_buf(fp, broot.data_off & ~HAMMER2_OFF_MASK_RADIX, sizeof(*vols[i])); + if (vols[i] == NULL) + errx(1, "failed to read volume header"); broot.mirror_tid = vols[i]->voldata.mirror_tid; if (best_i < 0 || best.mirror_tid < broot.mirror_tid) { best_i = i; diff --git a/usr.sbin/fstyp/ntfs.c b/usr.sbin/fstyp/ntfs.c index a3457c285edc..be8095d5ee27 100644 --- a/usr.sbin/fstyp/ntfs.c +++ b/usr.sbin/fstyp/ntfs.c @@ -137,9 +137,8 @@ fstyp_ntfs(FILE *fp, char *label, size_t size) struct ntfs_filerec *fr; struct ntfs_attr *atr; off_t voloff; - char *ap; int8_t mftrecsz; - int recsize; + size_t recsize; #endif /* WITH_ICONV */ filerecp = NULL; @@ -152,7 +151,8 @@ fstyp_ntfs(FILE *fp, char *label, size_t size) goto ok; mftrecsz = bf->bf_mftrecsz; - recsize = (mftrecsz > 0) ? (mftrecsz * bf->bf_bps * bf->bf_spc) : (1 << -mftrecsz); + recsize = (mftrecsz > 0) ? + (mftrecsz * bf->bf_bps * bf->bf_spc) : (1 << -mftrecsz); voloff = bf->bf_mftcn * bf->bf_spc * bf->bf_bps + recsize * NTFS_VOLUMEINO; @@ -165,16 +165,28 @@ fstyp_ntfs(FILE *fp, char *label, size_t size) if (fr->fr_hdrmagic != NTFS_FILEMAGIC) goto fail; - for (ap = filerecp + fr->fr_attroff; - atr = (struct ntfs_attr *)ap, (int)atr->a_type != -1; - ap += atr->reclen) { - if (atr->a_type != NTFS_A_VOLUMENAME) - continue; - - convert_label(ap + atr->a_dataoff, - atr->a_datalen, label, size); - break; + for (size_t ioff = fr->fr_attroff; + ioff + sizeof(struct ntfs_attr) < recsize; + ioff += atr->reclen) { + atr = (struct ntfs_attr *)(filerecp + ioff); + if ((int)atr->a_type == -1) + goto ok; + if (atr->a_type == NTFS_A_VOLUMENAME) { + if ((size_t)atr->a_dataoff + atr->a_datalen > recsize) { + warnx("ntfs: Volume name attribute overflow"); + goto fail; + } + convert_label(filerecp + ioff + atr->a_dataoff, + atr->a_datalen, label, size); + goto ok; + } + if (atr->reclen == 0) { + warnx("ntfs: Invalid attribute record length"); + goto fail; + } } + warnx("ntfs: Volume name not found"); + goto fail; ok: #else