xnu-792.17.14.tar.gz

[apple/xnu.git] / bsd / ufs / ffs / ffs_vfsops.c

diff --git a/bsd/ufs/ffs/ffs_vfsops.c b/bsd/ufs/ffs/ffs_vfsops.c
index 06d21d70aacd2423499ed152a5ff887c881a646d..a9e787a49cd772258d6dca729827349d34dc4e62 100644 (file)
--- a/bsd/ufs/ffs/ffs_vfsops.c
+++ b/bsd/ufs/ffs/ffs_vfsops.c
@@ -1,23 +1,29 @@
 /*
  * Copyright (c) 2000-2004 Apple Computer, Inc. All rights reserved.
  *
- * @APPLE_LICENSE_HEADER_START@
+ * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
  * 
- * The contents of this file constitute Original Code as defined in and
- * are subject to the Apple Public Source License Version 1.1 (the
- * "License").  You may not use this file except in compliance with the
- * License.  Please obtain a copy of the License at
- * http://www.apple.com/publicsource and read it before using this file.
+ * This file contains Original Code and/or Modifications of Original Code
+ * as defined in and that are subject to the Apple Public Source License
+ * Version 2.0 (the 'License'). You may not use this file except in
+ * compliance with the License. The rights granted to you under the License
+ * may not be used to create, or enable the creation or redistribution of,
+ * unlawful or unlicensed copies of an Apple operating system, or to
+ * circumvent, violate, or enable the circumvention or violation of, any
+ * terms of an Apple operating system software license agreement.
  * 
- * This Original Code and all software distributed under the License are
- * distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY KIND, EITHER
+ * Please obtain a copy of the License at
+ * http://www.opensource.apple.com/apsl/ and read it before using this file.
+ * 
+ * The Original Code and all software distributed under the License are
+ * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT.  Please see the
- * License for the specific language governing rights and limitations
- * under the License.
+ * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
+ * Please see the License for the specific language governing rights and
+ * limitations under the License.
  * 
- * @APPLE_LICENSE_HEADER_END@
+ * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  */
 /* Copyright (c) 1995 NeXT Computer, Inc. All Rights Reserved */
 /*
@@ -353,7 +359,11 @@ ffs_reload(struct mount *mountp, kauth_cred_t cred, struct proc *p)
        newfs = (struct fs *)buf_dataptr(bp);
 #if REV_ENDIAN_FS
        if (rev_endian) {
-               byte_swap_sbin(newfs);
+               error = byte_swap_sbin(newfs);
+               if (error) {
+                       buf_brelse(bp);
+                       return (error);
+               }
        }
 #endif /* REV_ENDIAN_FS */
        if (newfs->fs_magic != FS_MAGIC || newfs->fs_bsize > MAXBSIZE ||
@@ -502,7 +512,9 @@ ffs_mountfs(devvp, mp, context)
                        error = EINVAL;
                        goto out;
                }
-               byte_swap_sbin(fs);
+               if (error = byte_swap_sbin(fs))
+                       goto out;
+
                if (fs->fs_magic != FS_MAGIC || fs->fs_bsize > MAXBSIZE ||
                        fs->fs_bsize < sizeof(struct fs)) {
                        byte_swap_sbout(fs);
@@ -522,6 +534,14 @@ ffs_mountfs(devvp, mp, context)
                goto out;
        }
 
+       if (fs->fs_sbsize < 0 || fs->fs_sbsize > SBSIZE) {
+               error = EINVAL;
+               goto out;
+       }
+ 
+        /*
+         * Buffer cache does not handle multiple pages in a buf when
+
 
        /*
         * Buffer cache does not handle multiple pages in a buf when
@@ -631,10 +651,28 @@ ffs_mountfs(devvp, mp, context)
        bp = NULL;
        fs = ump->um_fs;
        fs->fs_ronly = ronly;
+       if (fs->fs_cssize < 1 || fs->fs_fsize < 1 || fs->fs_ncg < 1) {
+               error = EINVAL;
+               goto out;
+       }
+       if (fs->fs_frag < 1 || fs->fs_frag > MAXFRAG) {
+               error = EINVAL;
+               goto out;
+       }
+
        size = fs->fs_cssize;
        blks = howmany(size, fs->fs_fsize);
-       if (fs->fs_contigsumsize > 0)
+       if (fs->fs_contigsumsize > 0) {
+               if (fs->fs_ncg > INT_MAX / sizeof(int32_t) || size > INT_MAX - fs->fs_ncg * sizeof(int32_t)) {
+                       error = EINVAL;
+                       goto out;
+               }
                size += fs->fs_ncg * sizeof(int32_t);
+       }
+       if (fs->fs_ncg > INT_MAX / sizeof(u_int8_t) || size > INT_MAX - fs->fs_ncg * sizeof(u_int8_t)) {
+               error = EINVAL;
+               goto out;
+       }
        size += fs->fs_ncg * sizeof(u_int8_t);
        space = _MALLOC((u_long)size, M_UFSMNT, M_WAITOK);
        fs->fs_csp = space;