From nobody Mon Oct 28 15:14:44 2024 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4XccPc3W3Gz5bSXf; Mon, 28 Oct 2024 15:14:44 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R10" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4XccPc34mlz4tNB; Mon, 28 Oct 2024 15:14:44 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1730128484; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=dG2Za7mkC5lLORqIejH1lINh0vMqvFW6WwTTyuU3zEc=; b=Gv4ta1uaAMNL+dkPbZcMm1ARvSwLm2228Y7ZrhnOOPfqBgonu9jSPy81wGHtw26TfHzsj6 jkpMI8tdw2nE1erTxTmqWibmak5HxdsElX0jbIUOQtCV2TJTVR24+QAdBGE1qGgr55nqpJ SSmIoihN4S3Xvp1OyhNNN3n6q+lx6gHlQaIZSoFSFWMNsBtKoeVRjpqtbz8psrvGPHTkSz sj6iIVZ43wdIomWgzCzLNJlsSNtAosp8POosX9fuZKShuh3iAC/V70rWuABLf6uH8+y7WU Zyaa8ezP4Bf+wuxsNH0r+97RaBDlGrBrcD5xq0JTg3NbulTvZI8TGGO9nejxdw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1730128484; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=dG2Za7mkC5lLORqIejH1lINh0vMqvFW6WwTTyuU3zEc=; b=a/XidCAkO5dQsZrQdMPQixI+8ra9OuDzmOwQjbcKLmnM+z/78kgmL64jKzm21JoWOy21xI QA1iGKUbsdW/pknjgU4eKAIvIVsxn6I/aZ6+yEXt6Xe2GQRAlaMyxlxBVmb/RnH6MGsCgc yNriLMk3D9tA7s1M4CWXmqhYhKm694XA7qxwz33a9EzLcvsghXrCYuxc/7DhAVWdigI/vR zrjwhiPZV8mVkZMsB7H2SqsSt48H4LXGgHt8qQGRAR6dJsX/+KuCyL6gZWOiEVtT5dj8TD xdrXrWc29ydpT9RdQKcgb7sTey06CciX6K/3qZFnkmRMi1IFgu/pNz6FNfY05A== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1730128484; a=rsa-sha256; cv=none; b=sTK8122NxyZ6NORE+ens/7GC+nVIrAxLrAX4hTmCYMVMjbyp97BrEFfTSiJKkcNueXwImP /0zghCeljQCPhhEo8HwMagvX6kv5HxB0xxaJhaCuQReVCrC8PH5XclcFyL4bF2ob/9ViUz Y59afB0OhUuh4qe/HxnSsOE57l6M89YhqVZ1RNi720kPA08U66j2xfYggpkdz3ouhc/qwg KdveKCAHtBIQNLHitXG7yvnRsAW2RaWu2qYhcw6Z0l9jnwQbAilu7B0IltPnFvpybtcirS rGzggpLfp9MkP0eHKWxW5O44PEnZmhdW8bQYwQpeq+tt/0GX6K3bhizEMdmHlQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4XccPc2hzQzkZY; Mon, 28 Oct 2024 15:14:44 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 49SFEik5053649; Mon, 28 Oct 2024 15:14:44 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 49SFEial053646; Mon, 28 Oct 2024 15:14:44 GMT (envelope-from git) Date: Mon, 28 Oct 2024 15:14:44 GMT Message-Id: <202410281514.49SFEial053646@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Mark Johnston Subject: git: 878ede1a0d0f - main - fstyp: Fix some memory safety bugs List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 878ede1a0d0f10f851b2bc54be1e28f512bfc016 Auto-Submitted: auto-generated The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=878ede1a0d0f10f851b2bc54be1e28f512bfc016 commit 878ede1a0d0f10f851b2bc54be1e28f512bfc016 Author: Mark Johnston AuthorDate: 2024-10-28 13:51:58 +0000 Commit: Mark Johnston CommitDate: 2024-10-28 15:03:53 +0000 fstyp: Fix some memory safety bugs In the hammer2 label reader, make sure to check for a NULL return from read_buf(). In the NTFS label reader, - Avoid an infinite loop if a record length is 0. - Avoid walking past the end of the buffer. - When a label is found, avoid reading past the end of the buffer. PR: 278281 Reviewed by: emaste MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D47292 --- usr.sbin/fstyp/hammer2.c | 2 ++ usr.sbin/fstyp/ntfs.c | 36 ++++++++++++++++++++++++------------ 2 files changed, 26 insertions(+), 12 deletions(-) diff --git a/usr.sbin/fstyp/hammer2.c b/usr.sbin/fstyp/hammer2.c index e0c036c7442a..aeb29762fb6b 100644 --- a/usr.sbin/fstyp/hammer2.c +++ b/usr.sbin/fstyp/hammer2.c @@ -220,6 +220,8 @@ read_label(FILE *fp, char *label, size_t size) broot.data_off = (i * HAMMER2_ZONE_BYTES64) | HAMMER2_PBUFRADIX; vols[i] = read_buf(fp, broot.data_off & ~HAMMER2_OFF_MASK_RADIX, sizeof(*vols[i])); + if (vols[i] == NULL) + errx(1, "failed to read volume header"); broot.mirror_tid = vols[i]->voldata.mirror_tid; if (best_i < 0 || best.mirror_tid < broot.mirror_tid) { best_i = i; diff --git a/usr.sbin/fstyp/ntfs.c b/usr.sbin/fstyp/ntfs.c index a3457c285edc..be8095d5ee27 100644 --- a/usr.sbin/fstyp/ntfs.c +++ b/usr.sbin/fstyp/ntfs.c @@ -137,9 +137,8 @@ fstyp_ntfs(FILE *fp, char *label, size_t size) struct ntfs_filerec *fr; struct ntfs_attr *atr; off_t voloff; - char *ap; int8_t mftrecsz; - int recsize; + size_t recsize; #endif /* WITH_ICONV */ filerecp = NULL; @@ -152,7 +151,8 @@ fstyp_ntfs(FILE *fp, char *label, size_t size) goto ok; mftrecsz = bf->bf_mftrecsz; - recsize = (mftrecsz > 0) ? (mftrecsz * bf->bf_bps * bf->bf_spc) : (1 << -mftrecsz); + recsize = (mftrecsz > 0) ? + (mftrecsz * bf->bf_bps * bf->bf_spc) : (1 << -mftrecsz); voloff = bf->bf_mftcn * bf->bf_spc * bf->bf_bps + recsize * NTFS_VOLUMEINO; @@ -165,16 +165,28 @@ fstyp_ntfs(FILE *fp, char *label, size_t size) if (fr->fr_hdrmagic != NTFS_FILEMAGIC) goto fail; - for (ap = filerecp + fr->fr_attroff; - atr = (struct ntfs_attr *)ap, (int)atr->a_type != -1; - ap += atr->reclen) { - if (atr->a_type != NTFS_A_VOLUMENAME) - continue; - - convert_label(ap + atr->a_dataoff, - atr->a_datalen, label, size); - break; + for (size_t ioff = fr->fr_attroff; + ioff + sizeof(struct ntfs_attr) < recsize; + ioff += atr->reclen) { + atr = (struct ntfs_attr *)(filerecp + ioff); + if ((int)atr->a_type == -1) + goto ok; + if (atr->a_type == NTFS_A_VOLUMENAME) { + if ((size_t)atr->a_dataoff + atr->a_datalen > recsize) { + warnx("ntfs: Volume name attribute overflow"); + goto fail; + } + convert_label(filerecp + ioff + atr->a_dataoff, + atr->a_datalen, label, size); + goto ok; + } + if (atr->reclen == 0) { + warnx("ntfs: Invalid attribute record length"); + goto fail; + } } + warnx("ntfs: Volume name not found"); + goto fail; ok: #else