DragonFlyBSD Kernel Audit
DF-2554 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/vfs/ntfs/ntfs_vfsops.c b/sys/vfs/ntfs/ntfs_vfsops.c
--- a/sys/vfs/ntfs/ntfs_vfsops.c
+++ b/sys/vfs/ntfs/ntfs_vfsops.c
@@ -346,6 +346,18 @@
 		goto out;
 	}
 
+	/*
+	 * Validate geometry fields taken from the untrusted boot sector.
+	 * ntm_bps and ntm_spc are used as divisors (ntfs_vfsops.c:354,
+	 * and ntfs_btocn/cntob via ntfs.h:289-291).  A zero value causes
+	 * an integer divide fault (#DE) at mount.  (DF-2554)
+	 */
+	if (ntmp->ntm_bps == 0 || ntmp->ntm_spc == 0) {
+		error = EINVAL;
+		dprintf(("ntfs_mountfs: invalid geometry (bps/spc)\n"));
+		goto out;
+	}
+
 	{
 		int8_t cpr = ntmp->ntm_mftrecsz;
 		if( cpr > 0 )