diff options
| author | Ted Unangst <tedu@cvs.openbsd.org> | 2003-10-22 19:04:24 +0000 |
|---|---|---|
| committer | Ted Unangst <tedu@cvs.openbsd.org> | 2003-10-22 19:04:24 +0000 |
| commit | da83f0b9bfa8df955a54a117dc1fe674e6e27f77 (patch) | |
| tree | 08237c6c66ee859b28ec70404d73ae3ad3bbe575 /sys/msdosfs/msdosfs_fat.c | |
| parent | 6e363212d16d26425498972bb2e01ed7035bb463 (diff) | |
from netbsd:
Fix a panic that occurred when trying to traverse a corrupt msdosfs
filesystem. With this particular corruption, the code in pcbmap()
would compute an offset into an array that was way out of bounds,
so check the bounds before trying to access and return an error if
the offset would be out of bounds.
Diffstat (limited to 'sys/msdosfs/msdosfs_fat.c')
| -rw-r--r-- | sys/msdosfs/msdosfs_fat.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/sys/msdosfs/msdosfs_fat.c b/sys/msdosfs/msdosfs_fat.c index 6cda019aee4..1dadb7ab3e5 100644 --- a/sys/msdosfs/msdosfs_fat.c +++ b/sys/msdosfs/msdosfs_fat.c @@ -1,4 +1,4 @@ -/* $OpenBSD: msdosfs_fat.c,v 1.11 2002/03/14 01:27:09 millert Exp $ */ +/* $OpenBSD: msdosfs_fat.c,v 1.12 2003/10/22 19:04:23 tedu Exp $ */ /* $NetBSD: msdosfs_fat.c,v 1.26 1997/10/17 11:24:02 ws Exp $ */ /*- @@ -232,6 +232,11 @@ pcbmap(dep, findcn, bnp, cnp, sp) bp_bn = bn; } prevcn = cn; + if (bo >= bsize) { + if (bp) + brelse(bp); + return (EIO); + } if (FAT32(pmp)) cn = getulong(&bp->b_data[bo]); else |