Bug 258930 - sysutils/fusefs-ntfs: corrupt file system can cause seg fault in ntfs_attr_record_resize()
Summary: sysutils/fusefs-ntfs: corrupt file system can cause seg fault in ntfs_attr_re...
Status: New
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Only Me
Assignee: freebsd-ports-bugs (Nobody)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2021-10-04 17:10 UTC by Robert Morris
Modified: 2021-10-04 17:10 UTC (History)
1 user (show)

See Also:
bugzilla: maintainer-feedback? (freebsd)

Attachments
sysutils/fusefs-ntfs: this disk image causes a seg fault in ntfs_attr_record_resize() (121.54 KB, application/x-gzip)
2021-10-04 17:10 UTC, Robert Morris 		no flags Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Robert Morris 2021-10-04 17:10:24 UTC 
Created attachment 228440 [details]
sysutils/fusefs-ntfs: this disk image causes a seg fault in ntfs_attr_record_resize()

The attached corrupt NTFS disk image causes this call to memmove() in
ntfs_attr_record_resize() to crash:

                memmove((u8 *)a + new_size, (u8 *)a + attr_size,
                        old_size - ((u8 *)a - (u8 *)m) - attr_size);

I believe problem is that the third argument is negative -- or actually
huge, since size_t is unsigned.

% gunzip ntx7.img.gz 
% sudo mdconfig -f ntx7.img 
md0
% sudo ntfs-3g /dev/md0p1 /mnt
Did not find any restart pages in $LogFile and it was not empty.
The file system wasn't safely closed on Windows. Fixing.
ntfs_attr_find: Corrupt inode (2): Input/output error
Non-positive free clusters (0)!
Non-positive free clusters (0)!
Segmentation fault
% ntfs-3g --version
ntfs-3g 2017.3.23 external FUSE 29
% uname -a
FreeBSD xxx 13.0-RELEASE-p4 FreeBSD 13.0-RELEASE-p4 #0: Tue Aug 24 07:33:27 UTC 2021     root@amd64-builder.daemonology.net:/usr/obj/usr/src/amd64.amd64/sys/GENERIC  amd64

The backtrace:

#0  0x00000000402a725a in memmove () from /lib/libc.so.7
#1  0x00000000400b0d56 in ntfs_attr_record_resize (m=0x409d6400, a=0x409d6508, 
    new_size=80) at attrib.c:4536
#2  0x00000000400b31f8 in ntfs_attr_update_mapping_pairs_i (na=0x40810500, 
    from_vcn=0, holes=<optimized out>) at attrib.c:5795
#3  0x00000000400af714 in ntfs_attr_update_mapping_pairs (na=0x409d6558, 
    from_vcn=1107296256) at attrib.c:6003
#4  0x00000000400aed3a in ntfs_attr_pwrite_i (na=0x40810500, pos=0, count=0, 
    b=<optimized out>) at attrib.c:2249
#5  0x00000000400ae360 in ntfs_attr_pwrite (na=0x40810500, pos=0, count=8192, 
    b=0x3fffffc758) at attrib.c:2351
#6  0x00000000400c68a8 in ntfs_empty_logfile (na=0x40810500) at logfile.c:731
#7  0x00000000400d60e2 in ntfs_logfile_reset (vol=<optimized out>)
    at volume.c:1673
#8  0x00000000400d5ed6 in ntfs_device_mount (dev=<optimized out>, 
    flags=<optimized out>) at volume.c:1268
#9  0x00000000400d6478 in ntfs_mount (name=<optimized out>, flags=436207616)
    at volume.c:1386