From d587ff54f97255e8642a824dd13698deca8ba33c Mon Sep 17 00:00:00 2001
From: =?utf8?q?Jean-Pierre=20Andr=C3=A9?= <jpandre@users.sourceforge.net>
Date: Wed, 4 May 2016 09:24:51 +0200
Subject: [PATCH] Fixed segmentation fault on empty $LogFile in ntfsrecover

ntfsrecover -f -v <log file> receives a SIGSEGV because of trying to
read memory outside allocated buffer because of no sanity checks on
restart page header values. This happens on an empty $LogFile because
of no basic checks present. Attached patch adds basic checks similar
to those inside logfile library and allows tool to exit with more
suitable message.
(contributed by Rakesh Pandit)
---
 ntfsprogs/ntfsrecover.c | 35 +++++++++++++++++++++++++++++++----
 1 file changed, 31 insertions(+), 4 deletions(-)

diff --git a/ntfsprogs/ntfsrecover.c b/ntfsprogs/ntfsrecover.c
index 05a1d087..84caceea 100644
--- a/ntfsprogs/ntfsrecover.c
+++ b/ntfsprogs/ntfsrecover.c
@@ -3113,12 +3113,31 @@ static BOOL getlogfiledata(CONTEXT *ctx, const char *boot)
 	BOOL ok;
 	u32 off;
 	s64 size;
+	u32 system_page_size;
+	u32 log_page_size;
 
 	ok = FALSE;
 	fseek(ctx->file,0L,2);
 	size = ftell(ctx->file);
 	rph = (const RESTART_PAGE_HEADER*)boot;
 	off = le16_to_cpu(rph->restart_area_offset);
+	/*
+	 * If the system or log page sizes are smaller than the ntfs block size
+	 * or either is not a power of 2 we cannot handle this log file.
+	 */
+	system_page_size = le32_to_cpu(rph->system_page_size);
+	log_page_size = le32_to_cpu(rph->log_page_size);
+	if (system_page_size < NTFS_BLOCK_SIZE ||
+			log_page_size < NTFS_BLOCK_SIZE ||
+			system_page_size & (system_page_size - 1) ||
+			log_page_size & (log_page_size - 1)) {
+		printf("** Unsupported page size.\n");
+		goto out;
+	}
+	if (off & 7 || off > system_page_size) {
+		printf("** Inconsistent restart area offset.\n");
+		goto out;
+	}
 	rest = (const RESTART_AREA*)&boot[off];
 
 		/* estimate cluster size from log file size (unreliable) */
@@ -3142,6 +3161,7 @@ static BOOL getlogfiledata(CONTEXT *ctx, const char *boot)
 	mftrecsz = 0;
 	mftrecbits = 0;
 	ok = TRUE;
+out:
 	return (ok);
 }
 
@@ -3172,8 +3192,9 @@ static BOOL getvolumedata(CONTEXT *ctx, char *boot)
 		if (ctx->file
 		    && (!memcmp(boot,"RSTR",4) || !memcmp(boot,"CHKD",4))) {
 			printf("* Assuming a log file copy\n");
-			getlogfiledata(ctx, boot);
-			ok = TRUE;
+			ok = getlogfiledata(ctx, boot);
+			if (!ok)
+				goto out;
 		} else
 			fprintf(stderr,"** Not an NTFS image or log file\n");
 		}
@@ -3187,6 +3208,7 @@ static BOOL getvolumedata(CONTEXT *ctx, char *boot)
 		if (le16_to_cpu(rest->client_in_use_list) > 1)
 			printf("** multiple clients not implemented\n");
 	}
+out:
 	return (ok);
 }
 
@@ -3223,9 +3245,13 @@ static BOOL open_volume(CONTEXT *ctx, const char *device_name)
 			/* This appears to be a log file */
 			ctx->vol = (ntfs_volume*)NULL;
 			ok = getvolumedata(ctx, boot.buf);
-		}
-		if (!ok)
+			if (!ok) {
+				fclose(ctx->file);
+				goto out;
+			}
+		} else {
 			fclose(ctx->file);
+		}
 	}
 	if (!ok) {
 		/* Not a log file, assume an ntfs device, mount it */
@@ -3239,6 +3265,7 @@ static BOOL open_volume(CONTEXT *ctx, const char *device_name)
 				ntfs_umount(ctx->vol, TRUE);
 		}
 	}
+out:
 	return (ok);
 }
 
-- 
2.11.0