breeze/exfat
1
0
Fork 0
mirror of https://github.com/relan/exfat.git synced 2026-01-12 00:18:54 +08:00
Code Issues Packages Projects Releases Wiki Activity

Detect infinite loop in rootdir_size().

Browse Source 
Otherwise malformed FS can cause hang on mount.
This commit is contained in:
relan
2015-09-10 17:47:16 +03:00
parent 38d5c3a929
commit baa724ad0d
1 changed files with 21 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
libexfat/mount.c
View File

@@ -30,23 +30,32 @@
static uint64_t rootdir_size(const struct exfat* ef)
{
uint64_t clusters = 0;
uint32_t clusters = 0;
uint32_t clusters_max = le32_to_cpu(ef->sb->cluster_count);
cluster_t rootdir_cluster = le32_to_cpu(ef->sb->rootdir_cluster);
while (!CLUSTER_INVALID(rootdir_cluster))
/* Iterate all clusters of the root directory to calculate its size.
It can't be contiguous because there is no flag to indicate this. */
do
{
clusters++;
/* root directory cannot be contiguous because there is no flag
to indicate this */
if (clusters == clusters_max) /* infinite loop detected */
{
exfat_error("root directory cannot occupy all %d clusters",
clusters);
return 0;
}
if (CLUSTER_INVALID(rootdir_cluster))
{
exfat_error("bad cluster %#x while reading root directory",
rootdir_cluster);
return 0;
}
rootdir_cluster = exfat_next_cluster(ef, ef->root, rootdir_cluster);
clusters++;
}
if (rootdir_cluster != EXFAT_CLUSTER_END)
{
exfat_error("bad cluster %#x while reading root directory",
rootdir_cluster);
return 0;
}
return clusters * CLUSTER_SIZE(*ef->sb);
while (rootdir_cluster != EXFAT_CLUSTER_END);
return (uint64_t) clusters * CLUSTER_SIZE(*ef->sb);
}
static const char* get_option(const char* options, const char* option_name)