upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-05-28 04:12:45 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Verify that the BPB media descriptor and FAT ID match.

Browse source 
FAT specification requires that for valid FAT, FAT cluster 0 has a
specific value derived from the BPB media descriptor.  The lowest
(little-endian) byte must be equal to bpb.bpbMedia, other bits in the
cluster number must be all 1's.  Implement the check to reduce the
chance of the randomly corrupted FAT to pass the mount attempt.

Submitted by:	Siva Mahadevan <smahadevan@freebsdfoundation.org>
MFC after:	2 weeks
Differential revision:	https://reviews.freebsd.org/D12124
This commit is contained in:
Konstantin Belousov 2017-08-28 20:52:32 +00:00
parent 546ec4e544
commit fbcbbe78dc
1 changed files with 17 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

24
sys/fs/msdosfs/msdosfs_fat.c
View file

@ -908,19 +908,17 @@ fillinusemap(struct msdosfsmount *pmp)
* zero. These represent free clusters.
*/
pmp->pm_freeclustercount = 0;
for (cn = CLUST_FIRST; cn <= pmp->pm_maxcluster; cn++) {
for (cn = 0; cn <= pmp->pm_maxcluster; cn++) {
byteoffset = FATOFS(pmp, cn);
bo = byteoffset % pmp->pm_fatblocksize;
if (!bo || !bp) {
if (bo == 0) {
/* Read new FAT block */
if (bp)
if (bp != NULL)
brelse(bp);
fatblock(pmp, byteoffset, &bn, &bsize, NULL);
error = bread(pmp->pm_devvp, bn, bsize, NOCRED, &bp);
if (error) {
brelse(bp);
if (error != 0)
return (error);
}
}
if (FAT32(pmp))
readcn = getulong(&bp->b_data[bo]);
@ -930,7 +928,19 @@ fillinusemap(struct msdosfsmount *pmp)
readcn >>= 4;
readcn &= pmp->pm_fatmask;
if (readcn == CLUST_FREE)
/*
* Check if the FAT ID matches the BPB's media descriptor and
* all other bits are set to 1.
*/
if (cn == 0 && readcn != ((pmp->pm_fatmask & 0xffffff00) |
pmp->pm_bpb.bpbMedia)) {
#ifdef MSDOSFS_DEBUG
printf("mountmsdosfs(): Media descriptor in BPB"
"does not match FAT ID\n");
#endif
brelse(bp);
return (EINVAL);
} else if (readcn == CLUST_FREE)
usemap_free(pmp, cn);
}
if (bp != NULL)