fastfat buffer overflow can crash reactOS.

with reactos 41214 build on linux for qemu,
with cygwin-setup 1.7
with default cygwin installation (which stop just before being finished).

open a command line and type:

cd \cygwin bin
bash -i

This crashes ReactOS, log here after:

qemu -net nic -net user -serial stdio -m 128 -hda ReactOS.vmdk -cdrom cygwin-setup-1.7.iso
Could not open '/dev/kqemu' - QEMU acceleration layer not activated
(ntoskrnl/kd/kdio.c:220) -----------------------------------------------------
(ntoskrnl/kd/kdio.c:221) ReactOS 0.4-SVN (Build 20090531-r41214)
(ntoskrnl/kd/kdio.c:222) Command Line: DE DEBUGPORT=COM1 BAUDRATE=115200 SOS
(ntoskrnl/kd/kdio.c:223) ARC Paths: multi(0)disk(0)rdisk(0)partition(1) \ multi(0)disk(0)rdisk(0)partition(1) \ReactOS\
Used memory 130676Kb
(ntoskrnl/mm/mminit.c:284) Start End Type
(ntoskrnl/mm/mminit.c:285) 0x80000000 - 0x80800000 Undefined region
(ntoskrnl/mm/mminit.c:288) 0x80800000 - 0x80E00000 FreeLDR Kernel mapping region
(ntoskrnl/mm/mminit.c:291) 0x80E00000 - 0x80F00000 PFN Database region
(ntoskrnl/mm/mminit.c:298) 0x80F00000 - 0x87300000 Non paged pool region
(ntoskrnl/mm/mminit.c:301) 0x87300000 - 0x8D700000 Paged pool region
(ntoskrnl/ke/i386/kiinit.c:43) Large Page support detected but not yet taken advantage of!
(ntoskrnl/ke/i386/patpge.c:62) Advanced Memory features detected but not yet taken advantage of.
WARNING: KdDebuggerInitialize1 at drivers/base/kdcom/i386/kdbg.c:489 is UNIMPLEMENTED!
WARNING: IoReportResourceUsage at ntoskrnl/io/iomgr/iorsrce.c:700 is UNIMPLEMENTED!
WARNING: IoReportResourceUsage at ntoskrnl/io/iomgr/iorsrce.c:700 is UNIMPLEMENTED!
(ntoskrnl/io/iomgr/driver.c:1348) '\Driver\BUSLOGIC' initialization failed, status (0xc00000c0)
(drivers/storage/class/ramdisk/ramdisk.c:2310) RAM Disk Driver Initialized
(ntoskrnl/io/iomgr/deviface.c:892) IoRegisterDeviceInterface(): creating symbolic link ??\Root#*PNP0F13#0000#

{378de44c-56ef-11d1-bc8c-00a0c91405dd}

-> \Device\0000000d
(ntoskrnl/io/iomgr/deviface.c:892) IoRegisterDeviceInterface(): creating symbolic link ??\Root#*PNP0501#0000#

{86e0d1e0-8089-11d0-9ce4-08003e301f73}

-> \Device\0000000c
(ntoskrnl/io/iomgr/deviface.c:892) IoRegisterDeviceInterface(): creating symbolic link ??\Root#*PNP0501#0000#

{4d36e978-e325-11ce-bfc1-08002be10318}

-> \Device\0000000c
(drivers/network/ndis/ndis/miniport.c:2292)(NdisMRegisterMiniport) Initializing an NDIS 3.0 miniport
(drivers/bus/pci/pdo.c:1383) Unknown IOCTL 0x7
(ntoskrnl/io/iomgr/deviface.c:892) IoRegisterDeviceInterface(): creating symbolic link ??\Root#*PNP0303#0000#

{884b96c3-56ef-11d1-bc8c-00a0c91405dd}

-> \Device\0000000a
(ntoskrnl/io/iomgr/driver.c:1348) '\Driver\Floppy' initialization failed, status (0xc000000e)
WARNING: MmPageEntireDriver at ntoskrnl/mm/drvlck.c:88 is UNIMPLEMENTED!
WARNING: MmPageEntireDriver at ntoskrnl/mm/drvlck.c:88 is UNIMPLEMENTED!
WARNING: MmPageEntireDriver at ntoskrnl/mm/drvlck.c:88 is UNIMPLEMENTED!
(ntoskrnl/io/iomgr/file.c:414) Using IopParseDevice() hack
(subsystems/win32/win32k/ntuser/input.c:904)
Raw Input Thread 0x81368620
(subsystems/win32/win32k/objects/gdiobj.c:951) Attempted to lock object 0x0 of wrong type (Handle: 0x0, requested: 0x50000)
(subsystems/win32/win32k/objects/gdiobj.c:951) Attempted to lock object 0x0 of wrong type (Handle: 0x0, requested: 0x50000)
(subsystems/win32/win32k/objects/gdiobj.c:951) Attempted to lock object 0x0 of wrong type (Handle: 0x0, requested: 0x50000)
(subsystems/win32/win32k/objects/gdiobj.c:951) Attempted to lock object 0x0 of wrong type (Handle: 0x0, requested: 0x50000)
(subsystems/win32/win32k/objects/gdiobj.c:951) Attempted to lock object 0x0 of wrong type (Handle: 0x0, requested: 0x50000)
(subsystems/win32/win32k/objects/gdiobj.c:951) Attempted to lock object 0x0 of wrong type (Handle: 0x0, requested: 0x50000)
(subsystems/win32/win32k/objects/gdiobj.c:951) Attempted to lock object 0x0 of wrong type (Handle: 0x0, requested: 0x50000)
(subsystems/win32/win32k/objects/gdiobj.c:951) Attempted to lock object 0x0 of wrong type (Handle: 0x0, requested: 0x50000)
(subsystems/win32/win32k/objects/gdiobj.c:951) Attempted to lock object 0x0 of wrong type (Handle: 0x0, requested: 0x50000)
(subsystems/win32/win32k/objects/gdiobj.c:951) Attempted to lock object 0x0 of wrong type (Handle: 0x0, requested: 0x50000)
(subsystems/win32/win32k/objects/gdiobj.c:951) Attempted to lock object 0x0 of wrong type (Handle: 0x0, requested: 0x50000)
(subsystems/win32/win32k/objects/gdiobj.c:951) Attempted to lock object 0x0 of wrong type (Handle: 0x0, requested: 0x50000)
(subsystems/win32/win32k/objects/gdiobj.c:951) Attempted to lock object 0x0 of wrong type (Handle: 0x0, requested: 0x50000)
WARNING: NtUserInitialize at subsystems/win32/win32k/ntuser/ntstubs.c:823 is UNIMPLEMENTED!
(subsystems/win32/win32k/objects/gdiobj.c:951) Attempted to lock object 0x0 of wrong type (Handle: 0x0, requested: 0x50000)
(subsystems/win32/win32k/objects/gdiobj.c:951) Attempted to lock object 0x0 of wrong type (Handle: 0x0, requested: 0x50000)
(subsystems/win32/win32k/objects/gdiobj.c:951) Attempted to lock object 0x0 of wrong type (Handle: 0x0, requested: 0x50000)
(subsystems/win32/win32k/objects/gdiobj.c:951) Attempted to lock object 0x0 of wrong type (Handle: 0x0, requested: 0x50000)
(subsystems/win32/win32k/objects/gdiobj.c:951) Attempted to lock object 0x0 of wrong type (Handle: 0x0, requested: 0x50000)
(subsystems/win32/win32k/objects/gdiobj.c:951) Attempted to lock object 0x0 of wrong type (Handle: 0x0, requested: 0x50000)
(subsystems/win32/win32k/objects/gdiobj.c:951) Attempted to lock object 0x0 of wrong type (Handle: 0x0, requested: 0x50000)
(subsystems/win32/win32k/objects/gdiobj.c:951) Attempted to lock object 0x0 of wrong type (Handle: 0x0, requested: 0x50000)
(subsystems/win32/win32k/objects/gdiobj.c:951) Attempted to lock object 0x0 of wrong type (Handle: 0x0, requested: 0x50000)
(subsystems/win32/win32k/objects/gdiobj.c:951) Attempted to lock object 0x0 of wrong type (Handle: 0x0, requested: 0x50000)
(subsystems/win32/win32k/objects/gdiobj.c:951) Attempted to lock object 0x0 of wrong type (Handle: 0x0, requested: 0x50000)
(subsystems/win32/win32k/objects/gdiobj.c:951) Attempted to lock object 0x0 of wrong type (Handle: 0x0, requested: 0x50000)
(subsystems/win32/win32k/objects/gdiobj.c:814) Attempted to lock object 0x0 of wrong type (Handle: 0x0, requested: 0x40000)
(base/services/umpnpmgr/umpnpmgr.c:2298) Unknown event, GUID

{CB3A4009-46F0-11D0-B08F-00609713053F}
(base/services/umpnpmgr/umpnpmgr.c:2298) Unknown event, GUID {CB3A4009-46F0-11D0-B08F-00609713053F}

(base/services/umpnpmgr/umpnpmgr.c:2298) Unknown event, GUID

{CB3A4009-46F0-11D0-B08F-00609713053F}
(base/services/umpnpmgr/umpnpmgr.c:2298) Unknown event, GUID {CB3A4009-46F0-11D0-B08F-00609713053F}

(base/services/umpnpmgr/umpnpmgr.c:2298) Unknown event, GUID

{CB3A4009-46F0-11D0-B08F-00609713053F}
(base/services/umpnpmgr/umpnpmgr.c:2298) Unknown event, GUID {CB3A4009-46F0-11D0-B08F-00609713053F}

(subsystems/win32/win32k/ntuser/desktop.c:591) RtlQueryRegistryValues failed for PaintDesktopVersion (c0000034)
err:(base/system/winlogon/screensaver.c:86) ImpersonateLoggedOnUser() failed with error 5
err:(base/system/userinit/userinit.c:559) USERPREFERENCESMASK size: 4
err:(base/system/userinit/userinit.c:586) No User Preferences set in registry or incorrect type (error 2)
err:(dll/win32/shell32/classes.c:463) HCR_GetFolderAttributes should be called for simple PIDL's only!
err:(dll/win32/shell32/classes.c:463) HCR_GetFolderAttributes should be called for simple PIDL's only!
Using shell hooks for notification of shell events.
(subsystems/win32/win32k/ntuser/hook.c:1143) Not implemented: HookId 3 Global TRUE
err:(dll/win32/shell32/classes.c:463) HCR_GetFolderAttributes should be called for simple PIDL's only!
err:(dll/win32/shell32/classes.c:463) HCR_GetFolderAttributes should be called for simple PIDL's only!
err:(dll/win32/shell32/classes.c:463) HCR_GetFolderAttributes should be called for simple PIDL's only!
err:(dll/win32/shell32/classes.c:463) HCR_GetFolderAttributes should be called for simple PIDL's only!
err:(dll/win32/shell32/classes.c:463) HCR_GetFolderAttributes should be called for simple PIDL's only!
err:(dll/win32/setupapi/queue.c:1659) copy error 2 L"C:\\ReactOS\\inf
isapnp.sys" -> L"C:\\ReactOS\\System32\\drivers
isapnp.sys"
fixme:(dll/win32/shell32/shlview.c:1595) LVN_KEYDOWN key=0x0000000d
MainFrameBase::OpenShellFolders(): parent_pidl=C:\Documents and Settings\Administrator.REACTOS\Bureau
fixme:(dll/win32/shell32/she_ocmenu.c:1247) pidl is a shortcut
(subsystems/win32/win32k/ntuser/clipboard.c:1159) No WINSTA_ACCESSCLIPBOARD access
fixme:(dll/win32/shell32/shlexec.c:1541) flags ignored: 0x00010000
(subsystems/win32/csrss/win32csr/guiconsole.c:1524) GuiConsoleResize X 560 Y 375
(subsystems/win32/csrss/win32csr/guiconsole.c:1524) GuiConsoleResize X 560 Y 375
(subsystems/win32/csrss/win32csr/guiconsole.c:2151) received event Console 00930950 GuiData 009309D0 X 80 Y 25
WARNING: SeAppendPrivileges at ntoskrnl/se/priv.c:296 is UNIMPLEMENTED!
WARNING: SeAppendPrivileges at ntoskrnl/se/priv.c:296 is UNIMPLEMENTED!
WARNING: SeAppendPrivileges at ntoskrnl/se/priv.c:296 is UNIMPLEMENTED!
WARNING: SeAppendPrivileges at ntoskrnl/se/priv.c:296 is UNIMPLEMENTED!
Entered debugger on last-chance exception (Exception Code: 0xc0000005) (Page Fault)
Memory at 0x00000000 could not be read: Page not present.
kdb:> bt
Eip:
<FASTFAT.SYS:1a53>
Frames:
<FASTFAT.SYS:98e9>
<FASTFAT.SYS:99f9>
<NTOSKRNL.EXE:567ad (ntoskrnl/io/iomgr/irp.c:1137 (@IofCallDriver@8))>
<NTOSKRNL.EXE:4c379 (ntoskrnl/io/iomgr/file.c:705 (IopParseDevice@40))>
<NTOSKRNL.EXE:4cc33 (ntoskrnl/io/iomgr/file.c:923 (IopParseFile@40))>
<NTOSKRNL.EXE:9d2b3 (ntoskrnl/ob/obname.c:380 (ObpLookupObjectName@44))>
<NTOSKRNL.EXE:9b32b (ntoskrnl/ob/obhandle.c:2504 (ObOpenObjectByName@28))>
<NTOSKRNL.EXE:4dbf3 (ntoskrnl/io/iomgr/file.c:1803 (IoCreateFile@56))>
<NTOSKRNL.EXE:4eded (ntoskrnl/io/iomgr/file.c:2714 (NtOpenFile@24))>
<NTOSKRNL.EXE:bac0c (ntoskrnl/ke/i386/trap.s:244 (KiFastCallEntry))>
<ntdll.dll:6592>
<cygwin1.dll:88638>
<cygwin1.dll:66e2>
<cygwin1.dll:4a96>
<ec835356>
Couldn't access memory at 0x57E58959!
kdb:>