⬢ DragonFlyBSD Kernel Audit
DF-3159 / fix.diff
← back to finding ↓ download raw
--- a/sys/vfs/msdosfs/msdosfs_vnops.c
+++ b/sys/vfs/msdosfs/msdosfs_vnops.c
@@ -376,10 +376,15 @@ msdosfs_setattr(struct vop_setattr_args *ap)
 			if (vp->v_mount->mnt_flag & MNT_RDONLY)
 				return (EROFS);
+			/*
+			 * The on-disk dirent size field is 32-bit; reject
+			 * sizes the write path also refuses (msdosfs_write,
+			 * vnops.c:618) instead of silently truncating them
+			 * on the next DE_EXTERNALIZE.
+			 */
+			if ((uoff_t)vap->va_size > MSDOSFS_FILESIZE_MAX)
+				return (EFBIG);
 			break;
 		default:
 			/*
 			 * According to POSIX, the result is unspecified