xnu-792.18.15.tar.gz

[apple/xnu.git] / bsd / ufs / ffs / ffs_vfsops.c

diff --git a/bsd/ufs/ffs/ffs_vfsops.c b/bsd/ufs/ffs/ffs_vfsops.c
index 632d1aef340146ea753d4c8d1b425738e861e8f1..18b090997f0c57a9b20b8a5afd14c56750bf207b 100644 (file)
--- a/bsd/ufs/ffs/ffs_vfsops.c
+++ b/bsd/ufs/ffs/ffs_vfsops.c
@@ -1,31 +1,29 @@
 /*
  * Copyright (c) 2000-2004 Apple Computer, Inc. All rights reserved.
  *
 /*
  * Copyright (c) 2000-2004 Apple Computer, Inc. All rights reserved.
  *

- * @APPLE_LICENSE_OSREFERENCE_HEADER_START@
+ * @APPLE_OSREFERENCE_LICENSE_HEADER_START@

  * 
  * 

- * This file contains Original Code and/or Modifications of Original Code 
- * as defined in and that are subject to the Apple Public Source License 
- * Version 2.0 (the 'License'). You may not use this file except in 
- * compliance with the License.  The rights granted to you under the 
- * License may not be used to create, or enable the creation or 
- * redistribution of, unlawful or unlicensed copies of an Apple operating 
- * system, or to circumvent, violate, or enable the circumvention or 
- * violation of, any terms of an Apple operating system software license 
- * agreement.
- *
- * Please obtain a copy of the License at 
- * http://www.opensource.apple.com/apsl/ and read it before using this 
- * file.
- *
- * The Original Code and all software distributed under the License are 
- * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER 
- * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, 
- * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, 
- * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. 
- * Please see the License for the specific language governing rights and 
+ * This file contains Original Code and/or Modifications of Original Code
+ * as defined in and that are subject to the Apple Public Source License
+ * Version 2.0 (the 'License'). You may not use this file except in
+ * compliance with the License. The rights granted to you under the License
+ * may not be used to create, or enable the creation or redistribution of,
+ * unlawful or unlicensed copies of an Apple operating system, or to
+ * circumvent, violate, or enable the circumvention or violation of, any
+ * terms of an Apple operating system software license agreement.
+ * 
+ * Please obtain a copy of the License at
+ * http://www.opensource.apple.com/apsl/ and read it before using this file.
+ * 
+ * The Original Code and all software distributed under the License are
+ * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
+ * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
+ * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
+ * Please see the License for the specific language governing rights and

  * limitations under the License.
  * limitations under the License.

- *
- * @APPLE_LICENSE_OSREFERENCE_HEADER_END@
+ * 
+ * @APPLE_OSREFERENCE_LICENSE_HEADER_END@

  */
 /* Copyright (c) 1995 NeXT Computer, Inc. All Rights Reserved */
 /*
  */
 /* Copyright (c) 1995 NeXT Computer, Inc. All Rights Reserved */
 /*


@@ -361,7 +359,11 @@ ffs_reload(struct mount *mountp, kauth_cred_t cred, struct proc *p)
        newfs = (struct fs *)buf_dataptr(bp);
 #if REV_ENDIAN_FS
        if (rev_endian) {
        newfs = (struct fs *)buf_dataptr(bp);
 #if REV_ENDIAN_FS
        if (rev_endian) {

-               byte_swap_sbin(newfs);
+               error = byte_swap_sbin(newfs);
+               if (error) {
+                       buf_brelse(bp);
+                       return (error);
+               }

        }
 #endif /* REV_ENDIAN_FS */
        if (newfs->fs_magic != FS_MAGIC || newfs->fs_bsize > MAXBSIZE ||
        }
 #endif /* REV_ENDIAN_FS */
        if (newfs->fs_magic != FS_MAGIC || newfs->fs_bsize > MAXBSIZE ||


@@ -510,7 +512,9 @@ ffs_mountfs(devvp, mp, context)
                        error = EINVAL;
                        goto out;
                }
                        error = EINVAL;
                        goto out;
                }

-               byte_swap_sbin(fs);
+               if (error = byte_swap_sbin(fs))
+                       goto out;
+

                if (fs->fs_magic != FS_MAGIC || fs->fs_bsize > MAXBSIZE ||
                        fs->fs_bsize < sizeof(struct fs)) {
                        byte_swap_sbout(fs);
                if (fs->fs_magic != FS_MAGIC || fs->fs_bsize > MAXBSIZE ||
                        fs->fs_bsize < sizeof(struct fs)) {
                        byte_swap_sbout(fs);


@@ -530,6 +534,13 @@ ffs_mountfs(devvp, mp, context)
                goto out;
        }
 
                goto out;
        }
 

+       if (fs->fs_sbsize < 0 || fs->fs_sbsize > SBSIZE) {
+               error = EINVAL;
+               goto out;
+       }
+ 
+        /*
+         * Buffer cache does not handle multiple pages in a buf when

 
        /*
         * Buffer cache does not handle multiple pages in a buf when
 
        /*
         * Buffer cache does not handle multiple pages in a buf when


@@ -639,10 +650,28 @@ ffs_mountfs(devvp, mp, context)
        bp = NULL;
        fs = ump->um_fs;
        fs->fs_ronly = ronly;
        bp = NULL;
        fs = ump->um_fs;
        fs->fs_ronly = ronly;

+       if (fs->fs_cssize < 1 || fs->fs_fsize < 1 || fs->fs_ncg < 1) {
+               error = EINVAL;
+               goto out;
+       }
+       if (fs->fs_frag < 1 || fs->fs_frag > MAXFRAG) {
+               error = EINVAL;
+               goto out;
+       }
+

        size = fs->fs_cssize;
        blks = howmany(size, fs->fs_fsize);
        size = fs->fs_cssize;
        blks = howmany(size, fs->fs_fsize);

-       if (fs->fs_contigsumsize > 0)
+       if (fs->fs_contigsumsize > 0) {
+               if (fs->fs_ncg > INT_MAX / sizeof(int32_t) || size > INT_MAX - fs->fs_ncg * sizeof(int32_t)) {
+                       error = EINVAL;
+                       goto out;
+               }

                size += fs->fs_ncg * sizeof(int32_t);
                size += fs->fs_ncg * sizeof(int32_t);

+       }
+       if (fs->fs_ncg > INT_MAX / sizeof(u_int8_t) || size > INT_MAX - fs->fs_ncg * sizeof(u_int8_t)) {
+               error = EINVAL;
+               goto out;
+       }

        size += fs->fs_ncg * sizeof(u_int8_t);
        space = _MALLOC((u_long)size, M_UFSMNT, M_WAITOK);
        fs->fs_csp = space;
        size += fs->fs_ncg * sizeof(u_int8_t);
        space = _MALLOC((u_long)size, M_UFSMNT, M_WAITOK);
        fs->fs_csp = space;