Bug 127270 - fsck_msdosfs(8) may crash if BytesPerSec is zero
Summary: fsck_msdosfs(8) may crash if BytesPerSec is zero
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: bin (show other bugs)
Version: 7.1-PRERELEASE
Hardware: Any Any
: Normal Affects Only Me
Assignee: Xin LI
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2008-09-10 16:30 UTC by Anatoly Borodin
Modified: 2019-04-08 17:56 UTC (History)
2 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Anatoly Borodin 2008-09-10 16:30:01 UTC 
I use some FAT32 filesystem from a file image. It has errors, so I tried to check it with fsck_msdosfs /dev/md0 and got this:

** /dev/md0
Floating exception (core dumped)

I compiled fsck_msdosfs with debug information and found the faulty code block at /usr/src/sbin/fsck_msdosfs/boot.c:174

        boot->ClusterOffset = (boot->RootDirEnts * 32 + boot->BytesPerSec - 1)
            / boot->BytesPerSec
            + boot->ResSectors
            + boot->FATs * boot->FATsecs
            - CLUST_FIRST * boot->SecPerClust;

It fails because in my case boot->BytesPerSec == 0. IMHO such condition should be checked, fixed in the FS, but not crashed.
Comment 1 Bruce Cran freebsd_committer freebsd_triage 2010-09-24 21:51:15 UTC 
Responsible Changed
From-To: freebsd-bugs->freebsd-fs

Over to maintainer(s).
Comment 2 Enji Cooper freebsd_committer freebsd_triage 2015-11-15 05:46:58 UTC 
This should avoid the divide by 0, but I'd need to verify that the behavior is correct: 
https://people.freebsd.org/~ngie/bug127270.patch

This situation should occur if and when boot blocks 12 and 13 are 0, but there might need to be some additional conditions that need to be tripped in order for the divide by 0 to occur:

 66         boot->bpbBytesPerSec = block[11] + (block[12] << 8);
Comment 3 Enji Cooper freebsd_committer freebsd_triage 2017-11-05 20:59:18 UTC 
Handing a number of makefs, mtree, and msdosfs bugs in my queue over to emaste@.
Comment 4 Eitan Adler freebsd_committer freebsd_triage 2018-05-28 19:42:59 UTC 
batch change:

For bugs that match the following
-  Status Is In progress 
AND
- Untouched since 2018-01-01.
AND
- Affects Base System OR Documentation

DO:

Reset to open status.


Note:
I did a quick pass but if you are getting this email it might be worthwhile to double check to see if this bug ought to be closed.
Comment 5 Ed Maste freebsd_committer freebsd_triage 2018-05-28 20:32:03 UTC 
Reset asignee - I am not currently looking at this PR.
Comment 6 Xin LI freebsd_committer freebsd_triage 2019-04-08 17:56:57 UTC 
I think this was fixed in r335696, which will check the BPB BytesPerSec field and bail out.  This was merged to stable/11 (r336218) so closing this PR.