tools/dosfstools/patches/0012-fsck.fat-Fix-read-beyond-end-of-array-on-FAT12.patch

   1 From a41fc323f2ef38f884954a4ba3773a296fd809f8 Mon Sep 17 00:00:00 2001
   2 From: Andreas Bombe <aeb@debian.org>
   3 Date: Wed, 11 Mar 2015 21:45:04 +0100
   4 Subject: [PATCH 12/14] fsck.fat: Fix read beyond end of array on FAT12
   5
   6 When a FAT12 filesystem contains an odd number of clusters, setting the
   7 last cluster with set_fat() will trigger a read of the next entry,
   8 which does not exist in the fat array allocated for this.
   9
  10 Round up the allocation to an even number of FAT entries for FAT12 so
  11 that this is fixed without introducing special casing in get_fat().
  12
  13 Signed-off-by: Andreas Bombe <aeb@debian.org>
  14 ---
  15  src/fat.c | 14 +++++++++++---
  16  1 file changed, 11 insertions(+), 3 deletions(-)
  17
  18 diff --git a/src/fat.c b/src/fat.c
  19 index 027c586..5a92f56 100644
  20 --- a/src/fat.c
  21 +++ b/src/fat.c
  22 @@ -80,7 +80,7 @@ void get_fat(FAT_ENTRY * entry, void *fat, uint32_t cluster, DOS_FS * fs)
  23   */
  24  void read_fat(DOS_FS * fs)
  25  {
  26 -    int eff_size;
  27 +    int eff_size, alloc_size;
  28      uint32_t i;
  29      void *first, *second = NULL;
  30      int first_ok, second_ok;
  31 @@ -96,10 +96,18 @@ void read_fat(DOS_FS * fs)
  32
  33      total_num_clusters = fs->clusters + 2UL;
  34      eff_size = (total_num_clusters * fs->fat_bits + 7) / 8ULL;
  35 -    first = alloc(eff_size);
  36 +
  37 +    if (fs->fat_bits != 12)
  38 +           alloc_size = eff_size;
  39 +    else
  40 +           /* round up to an even number of FAT entries to avoid special
  41 +            * casing the last entry in get_fat() */
  42 +           alloc_size = (total_num_clusters * 12 + 23) / 24 * 3;
  43 +
  44 +    first = alloc(alloc_size);
  45      fs_read(fs->fat_start, eff_size, first);
  46      if (fs->nfats > 1) {
  47 -       second = alloc(eff_size);
  48 +       second = alloc(alloc_size);
  49         fs_read(fs->fat_start + fs->fat_size, eff_size, second);
  50      }
  51      if (second && memcmp(first, second, eff_size) != 0) {
  52 --
  53 1.9.1
  54