[src/netbsd-1-5]: src/sys/adosfs Pullup 1.43 [jdolecek]:

[tv <tv%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/5a8ee2e1b4c0
branches:  netbsd-1-5
changeset: 490172:5a8ee2e1b4c0
user:      tv <tv%NetBSD.org@localhost>
date:      Thu Nov 09 23:03:09 2000 +0000

description:
Pullup 1.43 [jdolecek]:
adosfs_mountfs(): check for zero amp->secsperblk before dividing by it (which
would cause trap and panic); it might be invalid if the mounted filesystem is
not actually adosfs.
This fixes kern/11335 by Petri Koistinen.

diffstat:

 sys/adosfs/advfsops.c |  14 +++++++++++---
 1 files changed, 11 insertions(+), 3 deletions(-)

diffs (40 lines):

diff -r b7e424b2d155 -r 5a8ee2e1b4c0 sys/adosfs/advfsops.c
--- a/sys/adosfs/advfsops.c     Thu Nov 09 22:57:30 2000 +0000
+++ b/sys/adosfs/advfsops.c     Thu Nov 09 23:03:09 2000 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: advfsops.c,v 1.42 2000/03/16 18:08:21 jdolecek Exp $   */
+/*     $NetBSD: advfsops.c,v 1.42.4.1 2000/11/09 23:03:09 tv Exp $     */
 
 /*
  * Copyright (c) 1994 Christian E. Hopps
@@ -211,8 +211,12 @@
                amp->bsize = parp->p_fsize * parp->p_frag;
                amp->secsperblk = parp->p_frag;
        }
-       amp->rootb = (parp->p_size / amp->secsperblk - 1 + parp->p_cpg) >> 1;
-       amp->numblks = parp->p_size / amp->secsperblk - parp->p_cpg;
+
+       /* invalid fs ? */
+       if (amp->secsperblk == 0) {
+               error = EINVAL;
+               goto fail;
+       }
 
        bp = NULL;
        if ((error = bread(devvp, (daddr_t)BBOFF,
@@ -223,11 +227,15 @@
        amp->dostype = adoswordn(bp, 0);
        brelse(bp);
 
+       /* basic sanity checks */
        if (amp->dostype < 0x444f5300 || amp->dostype > 0x444f5305) {
                error = EINVAL;
                goto fail;
        }
 
+       amp->rootb = (parp->p_size / amp->secsperblk - 1 + parp->p_cpg) >> 1;
+       amp->numblks = parp->p_size / amp->secsperblk - parp->p_cpg;
+
        amp->nwords = amp->bsize >> 2;
        amp->dbsize = amp->bsize - (IS_FFS(amp) ? 0 : OFS_DATA_OFFSET);
        amp->devvp = devvp;