DF-2554 / fix.diff
diff --git a/sys/vfs/ntfs/ntfs_vfsops.c b/sys/vfs/ntfs/ntfs_vfsops.c --- a/sys/vfs/ntfs/ntfs_vfsops.c +++ b/sys/vfs/ntfs/ntfs_vfsops.c @@ -346,6 +346,18 @@ goto out; } + /* + * Validate geometry fields taken from the untrusted boot sector. + * ntm_bps and ntm_spc are used as divisors (ntfs_vfsops.c:354, + * and ntfs_btocn/cntob via ntfs.h:289-291). A zero value causes + * an integer divide fault (#DE) at mount. (DF-2554) + */ + if (ntmp->ntm_bps == 0 || ntmp->ntm_spc == 0) { + error = EINVAL; + dprintf(("ntfs_mountfs: invalid geometry (bps/spc)\n")); + goto out; + } + { int8_t cpr = ntmp->ntm_mftrecsz; if( cpr > 0 ) |