Fail to mount a device if the bytes per sector in the BPB is less than

DEV_BSIZE or if the number of FAT sectors is zero.

1 files changed, 6 insertions, 0 deletions

diff --git a/sys/fs/msdosfs/msdosfs_vfsops.c b/sys/fs/msdosfs/msdosfs_vfsops.c
index b6ea514..3c5565e 100644
--- a/sys/fs/msdosfs/msdosfs_vfsops.c
+++ b/sys/fs/msdosfs/msdosfs_vfsops.c
@@ -359,6 +359,10 @@ mountmsdosfs(devvp, mp, td, argp)
 	 */
 	SecPerClust = b50->bpbSecPerClust;
 	pmp->pm_BytesPerSec = getushort(b50->bpbBytesPerSec);
+	if (pmp->pm_BytesPerSec < DEV_BSIZE) {
+		error = EINVAL;
+		goto error_exit;
+	}
 	pmp->pm_ResSectors = getushort(b50->bpbResSectors);
 	pmp->pm_FATs = b50->bpbFATs;
 	pmp->pm_RootDirEnts = getushort(b50->bpbRootDirEnts);
@@ -428,12 +432,14 @@ mountmsdosfs(devvp, mp, td, argp)
 	 * - logical sector size: power of 2, >= block size
 	 * - sectors per cluster: power of 2, >= 1
 	 * - number of sectors:   >= 1, <= size of partition
+	 * - number of FAT sectors: >= 1
 	 */
 	if ( (SecPerClust == 0)
 	  || (SecPerClust & (SecPerClust - 1))
 	  || (pmp->pm_BytesPerSec < DEV_BSIZE)
 	  || (pmp->pm_BytesPerSec & (pmp->pm_BytesPerSec - 1))
 	  || (pmp->pm_HugeSectors == 0)
+	  || (pmp->pm_FATsecs == 0)
 	) {
 		error = EINVAL;
 		goto error_exit;