Module Name:    src
Committed By:   christos
Date:           Fri Jul 11 14:59:53 UTC 2014

Modified Files:
        src/sbin/fsck_msdos: fat.c

Log Message:
Another infinite loop fix from OpenBSD from Tobias Stoeckmann:

You can download a "proof of concept" from my website:
http://www.stoeckmann.org/openbsd/poc.iso.

Take FAT1 and it'll infinitely loop.  This fix will complete
your previous commit.


To generate a diff of this commit:
cvs rdiff -u -r1.28 -r1.29 src/sbin/fsck_msdos/fat.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/sbin/fsck_msdos/fat.c
diff -u src/sbin/fsck_msdos/fat.c:1.28 src/sbin/fsck_msdos/fat.c:1.29
--- src/sbin/fsck_msdos/fat.c:1.28	Thu Jul 10 17:00:52 2014
+++ src/sbin/fsck_msdos/fat.c	Fri Jul 11 10:59:53 2014
@@ -1,4 +1,4 @@
-/*	$NetBSD: fat.c,v 1.28 2014/07/10 21:00:52 christos Exp $	*/
+/*	$NetBSD: fat.c,v 1.29 2014/07/11 14:59:53 christos Exp $	*/
 
 /*
  * Copyright (C) 1995, 1996, 1997 Wolfgang Solfrank
@@ -28,7 +28,7 @@
 
 #include <sys/cdefs.h>
 #ifndef lint
-__RCSID("$NetBSD: fat.c,v 1.28 2014/07/10 21:00:52 christos Exp $");
+__RCSID("$NetBSD: fat.c,v 1.29 2014/07/11 14:59:53 christos Exp $");
 #endif /* not lint */
 
 #include <stdlib.h>
@@ -392,7 +392,8 @@ checkfat(struct bootblock *boot, struct 
 
 		/* follow the chain and mark all clusters on the way */
 		for (len = 0, p = head;
-		     p >= CLUST_FIRST && p < boot->NumClusters;
+		     p >= CLUST_FIRST && p < boot->NumClusters &&
+		     fat[p].head != head;
 		     p = fat[p].next) {
 			fat[p].head = head;
 			len++;

Reply via email to