Github/fatfs
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

R0.16 patch 3

Browse Source 
July 10, 2026

Some vulnerabilities in FatFs R0.16 and earlier have been found and published.

CVE-2026-6682 (*)
A FAT BPB with broken FAT size field can collapse the files or lead a system crash.

CVE-2026-6687 (*)
An exFAT volume label with manipulated name length field can lead a buffer overflow.

CVE-2026-6688
LFN length is 255 UTF-16 encode units maximum. Please make sure the size of buffer is sufficient
to copy the read file name.

CVE-2026-6685
Wraparound in these expressions are intentional and not harmful.

CVE-2026-6683 (*)
An exFAT BPB with manipulated cluster count field can trigger a /0 and lead the system crash.

CVE-2026-6686
This behavior has been documented in the manual. Please be careful.

CVE-2026-6684
A manipulated table size field in GPT header can lead the system freeze. It does not cover FatFs R0.16.

This publishment of problems was reported via an SNS.
This commit is contained in:
Christopher Williams
2026-07-09 16:42:23 -07:00
parent 0ac7849364
commit dbd6192332
1 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
source/ff.c
+5 -3
View File
@@ -1,5 +1,5 @@
/*----------------------------------------------------------------------------/
/ FatFs - Generic FAT Filesystem Module R0.16 w/patch 1 /
/ FatFs - Generic FAT Filesystem Module R0.16 w/patch 2 /
/-----------------------------------------------------------------------------/
/
/ Copyright (C) 2025, ChaN, all right reserved.
@@ -41,6 +41,7 @@
#define MAX_FAT16 0xFFF5 /* Max FAT16 clusters (differs from specs, but right for real DOS/Windows behavior) */
#define MAX_FAT32 0x0FFFFFF5 /* Max FAT32 clusters (not defined in specs, practical limit) */
#define MAX_EXFAT 0x7FFFFFFD /* Max exFAT clusters (differs from specs, implementation limit) */
#define MIN_EXFAT 0x00000100 /* Min exFAT clusters (Not defined in specs, implementation limit) */
#define MIN_FAT12 32 /* Min FAT12 clusters (Not defined in specs, implementation limit) */
#define MIN_VOLUME 64 /* Min volume sectors (Not defined in specs, implementation limit) */
@@ -3547,7 +3548,7 @@ static FRESULT mount_volume ( /* FR_OK(0): successful, !=0: an error occurred */
if (fs->csize == 0) return FR_NO_FILESYSTEM; /* (Must be 1..32768 sectors) */
ncl = ld_32(fs->win + BPB_NumClusEx); /* Number of clusters */
if (ncl > MAX_EXFAT) return FR_NO_FILESYSTEM; /* (Too many clusters) */
if (ncl < MIN_EXFAT || ncl > MAX_EXFAT) return FR_NO_FILESYSTEM; /* (Wrong cluster count) */
fs->n_fatent = ncl + 2;
/* Boundaries and Limits */
@@ -3592,6 +3593,7 @@ static FRESULT mount_volume ( /* FR_OK(0): successful, !=0: an error occurred */
fasize = ld_16(fs->win + BPB_FATSz16); /* Number of sectors per FAT */
if (fasize == 0) fasize = ld_32(fs->win + BPB_FATSz32);
if (fasize >= 0x200000) return FR_NO_FILESYSTEM; /* (Must be smaller than max FAT size) */
fs->fsize = fasize;
fs->n_fats = fs->win[BPB_NumFATs]; /* Number of FATs */
@@ -5529,7 +5531,7 @@ FRESULT f_getlabel (
WCHAR hs;
UINT nw;
for (si = di = hs = 0; si < dj.dir[XDIR_NumLabel]; si++) { /* Extract volume label from 83 entry */
for (si = di = hs = 0; si < dj.dir[XDIR_NumLabel] && si < 11; si++) { /* Extract volume label from 83 entry */
wc = ld_16(dj.dir + XDIR_Label + si * 2);
if (hs == 0 && IsSurrogate(wc)) { /* Is the code a surrogate? */
hs = wc; continue;