Bug 257491

Summary: fsck_msdosfs can crash if input is bad
Product: Base System Reporter: Robert Morris <rtm>
Component: binAssignee: Xin LI <delphij>
Status: Open ---    
Severity: Affects Only Me CC: delphij, emaste, grahamperrin, lwhsu
Priority: ---    
Version: 13.0-RELEASE   
Hardware: amd64   
OS: Any   
See Also: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=262964
Attachments:
Description Flags
A FAT12 file system image that crashes fsck_msdosfs none

Description Robert Morris 2021-07-29 18:15:36 UTC 
Created attachment 226783 [details]
A FAT12 file system image that crashes fsck_msdosfs

I've attached a FAT12 image, fat.dat, that crashes fsck_msdosfs:

% fsck_msdosfs /tmp/fat.dat
** /tmp/fat.dat
** Phase 1 - Read FAT and checking connectivity
Bus error
% uname -a
FreeBSD xxx 13.0-RELEASE-p3 FreeBSD 13.0-RELEASE-p3 #0: Tue Jun 29 19:46:20 UTC 2021     root@amd64-builder.daemonology.net:/usr/obj/usr/src/amd64.amd64/sys/GENERIC  amd64

The problem seems to be that fat.dat has a FATsecs and bpbBytesPerSec
that multiply to more than the size of fat.dat; fsck_msdosfs calls mmap()
with that huge offset; mmap() returns a pointer (not MAP_FAILED);
fsck_msdosfs uses that pointer, but there's nothing there but a bus error.