Bug 258929 - sysutils/fusefs-ntfs: ntfs-3g can seg fault if a directory entry is corrupt
Summary: sysutils/fusefs-ntfs: ntfs-3g can seg fault if a directory entry is corrupt
Status: New
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Some People
Assignee: freebsd-ports-bugs (Nobody)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2021-10-04 16:43 UTC by Robert Morris
Modified: 2021-10-04 16:43 UTC (History)
1 user (show)

See Also:
bugzilla: maintainer-feedback? (freebsd)


Attachments
sysutils/fusefs-ntfs: this disk image causes ntfs-3g to seg fault due to a corrupt directory entry (121.56 KB, application/x-gzip)
2021-10-04 16:43 UTC, Robert Morris
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Robert Morris 2021-10-04 16:43:26 UTC
Created attachment 228439 [details]
sysutils/fusefs-ntfs: this disk image causes ntfs-3g to seg fault due to a corrupt directory entry

ntfs_inode_lookup_by_name() doesn't adequately bounds-check
the ie loop variable. If ir->index.entries_offset is huge,
then ie = &ir->index + ir->index.entries_offset will be
a wild pointer. If in addition ir->index.index_length is
huge, then the for-loop's check that ie < index_end won't
be effective. And the for loop will crash when it tries to
check that ie + ie->key_length < index_end, because ie isn't
valid.

I've attached a demo disk image.

% gunzip ntx6.img.gz
% sudo mdconfig -f ntx6.img
% sudo ntfs-3g /dev/md0p1 /mnt
Segmentation fault
% ntfs-3g --version
ntfs-3g 2017.3.23 external FUSE 29
% uname -a
FreeBSD xxx 13.0-RELEASE-p4 FreeBSD 13.0-RELEASE-p4 #0: Tue Aug 24 07:33:27 UTC 2021     root@amd64-builder.daemonology.net:/usr/obj/usr/src/amd64.amd64/sys/GENERIC  amd64

The backtrace:

#0  ntfs_inode_lookup_by_name (dir_ni=0x40869320, uname=0x40842010, 
    uname_len=7) at dir.c:307
#1  0x00000000400bb0b0 in ntfs_pathname_to_inode (vol=0x40845000, parent=0x0, 
    pathname=<optimized out>) at dir.c:782
#2  0x00000000400d113a in ntfs_open_secure (vol=<optimized out>)
    at security.c:4482
#3  0x00000000400d5dca in ntfs_device_mount (dev=<optimized out>, 
    flags=436207616) at volume.c:1243
#4  0x00000000400d6478 in ntfs_mount (name=<optimized out>, flags=436207616)
    at volume.c:1386