Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Panic when trying to load malformed filesystem #56

Open
5225225 opened this issue Dec 28, 2021 · 2 comments
Open

Panic when trying to load malformed filesystem #56

5225225 opened this issue Dec 28, 2021 · 2 comments
Labels

Comments

@5225225
Copy link

5225225 commented Dec 28, 2021

fn main() {
    let data = b"\x00\xfe\xf7\xf7\xf7\xf7\xf7\xf7\xb7\xf7\x00\x00\x02\x10\x00\xfc\x01\x00\x00\x00\x00\x00\x00\x00\x002222\x01\x00\x00\x0022222\xfc\x00\x00\x00\x00\x00\x00\x00222[[[[[21[[[[[[[[[[[[[[[[[[[[[[[222[[2222\x91\x91\x91\x91\x00\x00\x00\x00\xaa\xaa\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xb2\xb2\xb2\xb2\xb2\xb2\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xbe&\x00\x00\x00\x00\x00\x00\x00\xbez\x00\x01\x00\xd0\x00-\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x012\x94\x94\x94\x94\x94\x9422222222222222222222222222\x01\x00\x00\x0022222\xe1222222222221[[[[[[[[[[[[K\x1b[[[[[[[[[[[[\x00\x00\x00\x00\x00\x00\x00\x00\x012\x94\x94\x94\x94\x94\x94\xf7\xf7\xf7\xf7\xf73\x00\xaa\xaa\x11\x03\x00\x00\x002222222222222222222222\x00\x00\x00\x00\xaa\xaa\xe7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\xf7\x00\x00\x00\x00\x00\x00\x00\x11\x00\x00\x00\x00\x00\x00\x00\xaa\xaa\xaa\x02\x00\x98\x00\x00\x00\x002222\x01\x00\x00\x0022222\xfc\x00\x00\x00\x00\x00\x00\x00222[[[[[21[[[[[[[[[[[[[[[[[[[[[[[222[[2222\x91\x91\x91\x91\x91\x91\xd4\x91\x91\x91\x91t\x912222222222222222\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\xaa\xaa\xaa\xaa\xaa\xaa\xaa\x00\x00\x01\x00\x00\x00\xaa\xaa\x9cU\xaa\xaa\x01\xaa2\xaa\xff\xff\xff\xff\xff\xff\xff\x02]\x00\x01\xff";

    let storage = std::io::Cursor::new(data.to_vec());
    fatfs::FileSystem::new(storage, fatfs::FsOptions::new());
}

This panics with a multiply overflow error.

@rafalh rafalh added the bug label Dec 28, 2021
@rafalh
Copy link
Owner

rafalh commented Jan 2, 2022

Is this a valid FAT filesystem or a manually crafted data with a goal to crash the lib?
I can see multiple places where overflow could happen and I believe it would be better to just return errors in such cases but I also believe those cases should not occur in real world normally.
One option to handle this would be changing all multiplications to checked_mul() and somehow pass the error to the FileSystem::new function but I don't like how it would make all multiplications ugly

@5225225
Copy link
Author

5225225 commented Jan 2, 2022

Manually crafted, but I figured that bad behavior due to corrupted/malicious filesystems are in scope, you wouldn't want some OS to crash just because it's trying to read a filesystem with bad data.

Unfortunately, yeah, I'm not aware of any cleaner way than manually doing checked operations and propagating any errors upwards.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants