Snap for 6439596 from 4eef244fcb822a91ce5df3eeb9d27719c328d2d5 to qt-aml-tzdata-releaseq_tzdata_aml_297100400q_tzdata_aml_297100300q_tzdata_aml_297100000q_tzdata_aml_296200000q_tzdata_aml_295600118q_tzdata_aml_295600110q_tzdata_aml_295500002q_tzdata_aml_295500001q_tzdata_aml_294400310android-mainline-12.0.0_r54android-mainline-12.0.0_r111android-mainline-10.0.0_r13android-mainline-10.0.0_r12android-mainline-10.0.0_r11q_tzdata_aml_297100000android12-mainline-tzdata-releaseandroid10-mainline-tzdata-releaseandroid10-android13-mainline-tzdata-release

Change-Id: I3b9775083bd4827b5b561dbe61a8a0bb39457ae4

4 files changed, 126 insertions, 297 deletions

diff --git a/boot.c b/boot.c
index 33577ca..9e0958a 100644
--- a/boot.c
+++ b/boot.c
@@ -33,9 +33,6 @@ static const char rcsid[] =
   "$FreeBSD$";
 #endif /* not lint */
 
-#include <sys/param.h>
-
-#include <stdint.h>
 #include <stdlib.h>
 #include <string.h>
 #include <stdio.h>
@@ -49,8 +46,10 @@ readboot(int dosfs, struct bootblock *boot)
 {
 	u_char block[DOSBOOTBLOCKSIZE];
 	u_char fsinfo[2 * DOSBOOTBLOCKSIZE];
+	u_char backup[DOSBOOTBLOCKSIZE];
 	int ret = FSOK;
-
+	int i;
+	
 	if ((size_t)read(dosfs, block, sizeof block) != sizeof block) {
 		perr("could not read boot block");
 		return FSFATAL;
@@ -65,133 +64,61 @@ readboot(int dosfs, struct bootblock *boot)
 	memset(boot, 0, sizeof *boot);
 	boot->ValidFat = -1;
 
-	/* Decode BIOS Parameter Block */
-
-	/* Bytes per sector: can only be  512, 1024, 2048 and 4096. */
+	/* decode bios parameter block */
 	boot->bpbBytesPerSec = block[11] + (block[12] << 8);
-	if (boot->bpbBytesPerSec < DOSBOOTBLOCKSIZE_REAL ||
-	    boot->bpbBytesPerSec > DOSBOOTBLOCKSIZE ||
-	    !powerof2(boot->bpbBytesPerSec)) {
-		pfatal("Invalid sector size: %u", boot->bpbBytesPerSec);
-		return FSFATAL;
-	}
-
-	/* Sectors per cluster: can only be: 1, 2, 4, 8, 16, 32, 64, 128. */
 	boot->bpbSecPerClust = block[13];
-	if (boot->bpbSecPerClust == 0 || !powerof2(boot->bpbSecPerClust)) {
-		pfatal("Invalid cluster size: %u", boot->bpbSecPerClust);
-		return FSFATAL;
-	}
-
-	/* Reserved sectors: must be non-zero */
 	boot->bpbResSectors = block[14] + (block[15] << 8);
-	if (boot->bpbResSectors < 1) {
-		pfatal("Invalid reserved sectors: %u",
-		    boot->bpbResSectors);
-		return FSFATAL;
-	}
-
-	/* Number of FATs */
 	boot->bpbFATs = block[16];
-	if (boot->bpbFATs == 0) {
-		pfatal("Invalid number of FATs: %u", boot->bpbFATs);
-		return FSFATAL;
-	}
-
-	/* Root directory entries for FAT12 and FAT16 */
 	boot->bpbRootDirEnts = block[17] + (block[18] << 8);
-	if (!boot->bpbRootDirEnts) {
-		/* bpbRootDirEnts = 0 suggests that we are FAT32 */
-		boot->flags |= FAT32;
-	}
-
-	/* Total sectors (16 bits) */
 	boot->bpbSectors = block[19] + (block[20] << 8);
-	if (boot->bpbSectors != 0 && (boot->flags & FAT32)) {
-		pfatal("Invalid 16-bit total sector count on FAT32: %u",
-		    boot->bpbSectors);
-		return FSFATAL;
-	}
-
-	/* Media type: ignored */
 	boot->bpbMedia = block[21];
-
-	/* FAT12/FAT16: 16-bit count of sectors per FAT */
 	boot->bpbFATsmall = block[22] + (block[23] << 8);
-	if (boot->bpbFATsmall != 0 && (boot->flags & FAT32)) {
-		pfatal("Invalid 16-bit FAT sector count on FAT32: %u",
-		    boot->bpbFATsmall);
-		return FSFATAL;
-	}
-
-	/* Legacy CHS geometry numbers: ignored */
 	boot->SecPerTrack = block[24] + (block[25] << 8);
 	boot->bpbHeads = block[26] + (block[27] << 8);
-
-	/* Hidden sectors: ignored */
 	boot->bpbHiddenSecs = block[28] + (block[29] << 8) +
 	    (block[30] << 16) + (block[31] << 24);
-
-	/* Total sectors (32 bits) */
 	boot->bpbHugeSectors = block[32] + (block[33] << 8) +
 	    (block[34] << 16) + (block[35] << 24);
-	if (boot->bpbHugeSectors == 0) {
-		if (boot->flags & FAT32) {
-			pfatal("FAT32 with sector count of zero");
-			return FSFATAL;
-		} else if (boot->bpbSectors == 0) {
-			pfatal("FAT with sector count of zero");
-			return FSFATAL;
-		}
-		boot->NumSectors = boot->bpbSectors;
-	} else {
-		if (boot->bpbSectors != 0) {
-			pfatal("Invalid FAT sector count");
-			return FSFATAL;
-		}
-		boot->NumSectors = boot->bpbHugeSectors;
-	}
-
-
 
+	boot->FATsecs = boot->bpbFATsmall;
 
+	if (boot->bpbBytesPerSec % DOSBOOTBLOCKSIZE_REAL != 0 ||
+	    boot->bpbBytesPerSec / DOSBOOTBLOCKSIZE_REAL == 0) {
+		pfatal("Invalid sector size: %u", boot->bpbBytesPerSec);
+		return FSFATAL;
+	}
+	if (boot->bpbFATs == 0) {
+		pfatal("Invalid number of FATs: %u", boot->bpbFATs);
+		return FSFATAL;
+	}
+	if (!boot->bpbRootDirEnts)
+		boot->flags |= FAT32;
 	if (boot->flags & FAT32) {
-		/* If the OEM Name field is EXFAT, it's not FAT32, so bail */
-		if (!memcmp(&block[3], "EXFAT   ", 8)) {
-			pfatal("exFAT filesystem is not supported.");
-			return FSFATAL;
-		}
-
-		/* 32-bit count of sectors per FAT */
 		boot->FATsecs = block[36] + (block[37] << 8)
 				+ (block[38] << 16) + (block[39] << 24);
-
 		if (block[40] & 0x80)
 			boot->ValidFat = block[40] & 0x0f;
 
-		/* FAT32 version, bail out if not 0.0 */
+		/* check version number: */
 		if (block[42] || block[43]) {
+			/* Correct?				XXX */
 			pfatal("Unknown file system version: %x.%x",
 			       block[43], block[42]);
 			return FSFATAL;
 		}
-
-		/*
-		 * Cluster number of the first cluster of root directory.
-		 *
-		 * Should be 2 but do not require it.
-		 */
 		boot->bpbRootClust = block[44] + (block[45] << 8)
 			       + (block[46] << 16) + (block[47] << 24);
-
-		/* Sector number of the FSInfo structure, usually 1 */
 		boot->bpbFSInfo = block[48] + (block[49] << 8);
-
-		/* Sector number of the backup boot block, ignored */
 		boot->bpbBackup = block[50] + (block[51] << 8);
 
-		/* Check basic parameters */
-		if (boot->bpbFSInfo == 0) {
+		/* If the OEM Name field is EXFAT, it's not FAT32, so bail */
+		if (!memcmp(&block[3], "EXFAT   ", 8)) {
+			pfatal("exFAT filesystem is not supported.");
+			return FSFATAL;
+		}
+
+		/* check basic parameters */
+		if ((boot->bpbFSInfo == 0) || (boot->bpbSecPerClust == 0)) {
 			/*
 			 * Either the BIOS Parameter Block has been corrupted,
 			 * or this is not a FAT32 filesystem, most likely an
@@ -200,8 +127,6 @@ readboot(int dosfs, struct bootblock *boot)
 			pfatal("Invalid FAT32 Extended BIOS Parameter Block");
 			return FSFATAL;
 		}
-
-		/* Read in and verify the FSInfo block */
 		if (lseek(dosfs, boot->bpbFSInfo * boot->bpbBytesPerSec,
 		    SEEK_SET) != boot->bpbFSInfo * boot->bpbBytesPerSec
 		    || read(dosfs, fsinfo, sizeof fsinfo) != sizeof fsinfo) {
@@ -239,8 +164,8 @@ readboot(int dosfs, struct bootblock *boot)
 				ret = FSBOOTMOD;
 			} else
 				boot->bpbFSInfo = 0;
-		} else {
-			/* We appear to have a valid FSInfo block, decode */
+		}
+		if (boot->bpbFSInfo) {
 			boot->FSFree = fsinfo[0x1e8] + (fsinfo[0x1e9] << 8)
 				       + (fsinfo[0x1ea] << 16)
 				       + (fsinfo[0x1eb] << 24);
@@ -248,29 +173,51 @@ readboot(int dosfs, struct bootblock *boot)
 				       + (fsinfo[0x1ee] << 16)
 				       + (fsinfo[0x1ef] << 24);
 		}
-	} else {
-		/* !FAT32: FAT12/FAT16 */
-		boot->FATsecs = boot->bpbFATsmall;
-	}
 
-	if (boot->FATsecs > UINT32_MAX / boot->bpbFATs) {
-		pfatal("Invalid FATs(%u) with FATsecs(%zu)",
-			boot->bpbFATs, (size_t)boot->FATsecs);
-		return FSFATAL;
+		if (lseek(dosfs, boot->bpbBackup * boot->bpbBytesPerSec,
+		    SEEK_SET)
+		    != boot->bpbBackup * boot->bpbBytesPerSec
+		    || read(dosfs, backup, sizeof backup) != sizeof  backup) {
+			perr("could not read backup bootblock");
+			return FSFATAL;
+		}
+		backup[65] = block[65];				/* XXX */
+		if (memcmp(block + 11, backup + 11, 79)) {
+			/*
+			 * XXX We require a reference that explains
+			 * that these bytes need to match, or should
+			 * drop the check.  gdt@NetBSD has observed
+			 * filesystems that work fine under Windows XP
+			 * and NetBSD that do not match, so the
+			 * requirement is suspect.  For now, just
+			 * print out useful information and continue.
+			 */
+			pwarn("backup (block %d) mismatch with primary bootblock:\n",
+			        boot->bpbBackup);
+			for (i = 11; i < 11 + 90; i++) {
+				if (block[i] != backup[i])
+					pwarn("\ti=%d\tprimary 0x%02x\tbackup 0x%02x\n",
+					       i, block[i], backup[i]);
+			}
+		}
+		/* Check backup bpbFSInfo?					XXX */
 	}
 
-	boot->FirstCluster = (boot->bpbRootDirEnts * 32 +
-	    boot->bpbBytesPerSec - 1) / boot->bpbBytesPerSec +
-	    boot->bpbResSectors + boot->bpbFATs * boot->FATsecs;
-
-	if (boot->FirstCluster + boot->bpbSecPerClust > boot->NumSectors) {
-		pfatal("Cluster offset too large (%u clusters)\n",
-		    boot->FirstCluster);
+	if (boot->bpbSecPerClust == 0) {
+		pfatal("Invalid cluster size: %u", boot->bpbSecPerClust);
 		return FSFATAL;
 	}
-
-	boot->NumClusters = (boot->NumSectors - boot->FirstCluster) / boot->bpbSecPerClust +
-	    CLUST_FIRST;
+	if (boot->bpbSectors) {
+		boot->bpbHugeSectors = 0;
+		boot->NumSectors = boot->bpbSectors;
+	} else
+		boot->NumSectors = boot->bpbHugeSectors;
+	boot->ClusterOffset = (boot->bpbRootDirEnts * 32 +
+	    boot->bpbBytesPerSec - 1) / boot->bpbBytesPerSec +
+	    boot->bpbResSectors + boot->bpbFATs * boot->FATsecs -
+	    CLUST_FIRST * boot->bpbSecPerClust;
+	boot->NumClusters = (boot->NumSectors - boot->ClusterOffset) /
+	    boot->bpbSecPerClust;
 
 	if (boot->flags&FAT32)
 		boot->ClustMask = CLUST32_MASK;
diff --git a/dir.c b/dir.c
index 7e459c7..38c7014 100644
--- a/dir.c
+++ b/dir.c
@@ -35,8 +35,6 @@ static const char rcsid[] =
   "$FreeBSD$";
 #endif /* not lint */
 
-#include <assert.h>
-#include <inttypes.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -115,7 +113,7 @@ newDosDirEntry(void)
 	struct dosDirEntry *de;
 
 	if (!(de = freede)) {
-		if (!(de = malloc(sizeof *de)))
+		if (!(de = (struct dosDirEntry *)malloc(sizeof *de)))
 			return 0;
 	} else
 		freede = de->next;
@@ -140,7 +138,7 @@ newDirTodo(void)
 	struct dirTodoNode *dt;
 
 	if (!(dt = freedt)) {
-		if (!(dt = malloc(sizeof *dt)))
+		if (!(dt = (struct dirTodoNode *)malloc(sizeof *dt)))
 			return 0;
 	} else
 		freedt = dt->next;
@@ -169,24 +167,20 @@ fullpath(struct dosDirEntry *dir)
 	char *cp, *np;
 	int nl;
 
-	cp = namebuf + sizeof namebuf;
-	*--cp = '\0';
-
-	for(;;) {
+	cp = namebuf + sizeof namebuf - 1;
+	*cp = '\0';
+	do {
 		np = dir->lname[0] ? dir->lname : dir->name;
 		nl = strlen(np);
-		if (cp <= namebuf + 1 + nl) {
-			*--cp = '?';
+		if ((cp -= nl) <= namebuf + 1)
 			break;
-		}
-		cp -= nl;
 		memcpy(cp, np, nl);
-		dir = dir->parent;
-		if (!dir)
-			break;
 		*--cp = '/';
-	}
-
+	} while ((dir = dir->parent) != NULL);
+	if (dir)
+		*--cp = '?';
+	else
+		cp++;
 	return cp;
 }
 
@@ -224,6 +218,7 @@ int
 resetDosDirSection(struct bootblock *boot, struct fatEntry *fat)
 {
 	int b1, b2;
+	cl_t cl;
 	int ret = FSOK;
 	size_t len;
 
@@ -256,9 +251,24 @@ resetDosDirSection(struct bootblock *boot, struct fatEntry *fat)
 			       boot->bpbRootClust);
 			return FSFATAL;
 		}
-		if (fat[boot->bpbRootClust].head != boot->bpbRootClust) {
-			pfatal("Root directory doesn't start a cluster chain");
-			return FSFATAL;
+		cl = fat[boot->bpbRootClust].next;
+		if (cl < CLUST_FIRST
+		    || (cl >= CLUST_RSRVD && cl< CLUST_EOFS)
+		    || fat[boot->bpbRootClust].head != boot->bpbRootClust) {
+			if (cl == CLUST_FREE)
+				pwarn("Root directory starts with free cluster\n");
+			else if (cl >= CLUST_RSRVD)
+				pwarn("Root directory starts with cluster marked %s\n",
+				      rsrvdcltype(cl));
+			else {
+				pfatal("Root directory doesn't start a cluster chain");
+				return FSFATAL;
+			}
+			if (ask(1, "Fix")) {
+				fat[boot->bpbRootClust].next = CLUST_FREE;
+				ret = FSFATMOD;
+			} else
+				ret = FSFATAL;
 		}
 
 		fat[boot->bpbRootClust].flags |= FAT_USED;
@@ -317,14 +327,10 @@ delete(int f, struct bootblock *boot, struct fatEntry *fat, cl_t startcl,
 				break;
 			e = delbuf + endoff;
 		}
-		off = (startcl - CLUST_FIRST) * boot->bpbSecPerClust + boot->FirstCluster;
-
+		off = startcl * boot->bpbSecPerClust + boot->ClusterOffset;
 		off *= boot->bpbBytesPerSec;
-		if (lseek(f, off, SEEK_SET) != off) {
-			perr("Unable to lseek to %" PRId64, off);
-			return FSFATAL;
-		}
-		if (read(f, delbuf, clsz) != clsz) {
+		if (lseek(f, off, SEEK_SET) != off
+		    || read(f, delbuf, clsz) != clsz) {
 			perr("Unable to read directory");
 			return FSFATAL;
 		}
@@ -332,11 +338,8 @@ delete(int f, struct bootblock *boot, struct fatEntry *fat, cl_t startcl,
 			*s = SLOT_DELETED;
 			s += 32;
 		}
-		if (lseek(f, off, SEEK_SET) != off) {
-			perr("Unable to lseek to %" PRId64, off);
-			return FSFATAL;
-		}
-		if (write(f, delbuf, clsz) != clsz) {
+		if (lseek(f, off, SEEK_SET) != off
+		    || write(f, delbuf, clsz) != clsz) {
 			perr("Unable to write directory");
 			return FSFATAL;
 		}
@@ -433,75 +436,6 @@ checksize(struct bootblock *boot, struct fatEntry *fat, u_char *p,
 	return FSOK;
 }
 
-static const u_char dot_name[11]    = ".          ";
-static const u_char dotdot_name[11] = "..         ";
-
-/*
- * Basic sanity check if the subdirectory have good '.' and '..' entries,
- * and they are directory entries.  Further sanity checks are performed
- * when we traverse into it.
- */
-static int
-check_subdirectory(int f, struct bootblock *boot, struct dosDirEntry *dir)
-{
-	u_char *buf, *cp;
-	off_t off;
-	cl_t cl;
-	int retval = FSOK;
-
-	cl = dir->head;
-	if (dir->parent && (cl < CLUST_FIRST || cl >= boot->NumClusters)) {
-		return FSERROR;
-	}
-
-	if (!(boot->flags & FAT32) && !dir->parent) {
-		off = boot->bpbResSectors + boot->bpbFATs *
-			boot->FATsecs;
-	} else {
-		off = (cl - CLUST_FIRST) * boot->bpbSecPerClust + boot->FirstCluster;
-	}
-
-	/*
-	 * We only need to check the first two entries of the directory,
-	 * which is found in the first sector of the directory entry,
-	 * so read in only the first sector.
-	 */
-	buf = malloc(boot->bpbBytesPerSec);
-	if (buf == NULL) {
-		perr("No space for directory buffer (%u)",
-		    boot->bpbBytesPerSec);
-		return FSFATAL;
-	}
-
-	off *= boot->bpbBytesPerSec;
-	if (lseek(f, off, SEEK_SET) != off ||
-	    read(f, buf, boot->bpbBytesPerSec) != (ssize_t)boot->bpbBytesPerSec) {
-		perr("Unable to read directory");
-		free(buf);
-		return FSFATAL;
-	}
-
-	/*
-	 * Both `.' and `..' must be present and be the first two entries
-	 * and be ATTR_DIRECTORY of a valid subdirectory.
-	 */
-	cp = buf;
-	if (memcmp(cp, dot_name, sizeof(dot_name)) != 0 ||
-	    (cp[11] & ATTR_DIRECTORY) != ATTR_DIRECTORY) {
-		pwarn("%s: Incorrect `.' for %s.\n", __func__, dir->name);
-		retval |= FSERROR;
-	}
-	cp += 32;
-	if (memcmp(cp, dotdot_name, sizeof(dotdot_name)) != 0 ||
-	    (cp[11] & ATTR_DIRECTORY) != ATTR_DIRECTORY) {
-		pwarn("%s: Incorrect `..' for %s. \n", __func__, dir->name);
-		retval |= FSERROR;
-	}
-
-	free(buf);
-	return retval;
-}
-
 /*
  * Read a directory and
  *   - resolve long name records
@@ -539,7 +473,7 @@ readDosDirSection(int f, struct bootblock *boot, struct fatEntry *fat,
 			    boot->FATsecs;
 		} else {
 			last = boot->bpbSecPerClust * boot->bpbBytesPerSec;
-			off = (cl - CLUST_FIRST) * boot->bpbSecPerClust + boot->FirstCluster;
+			off = cl * boot->bpbSecPerClust + boot->ClusterOffset;
 		}
 
 		off *= boot->bpbBytesPerSec;
@@ -549,6 +483,9 @@ readDosDirSection(int f, struct bootblock *boot, struct fatEntry *fat,
 			return FSFATAL;
 		}
 		last /= 32;
+		/*
+		 * Check `.' and `..' entries here?			XXX
+		 */
 		for (p = buffer, i = 0; i < last; i++, p += 32) {
 			if (dir->fsckflags & DIREMPWARN) {
 				*p = SLOT_EMPTY;
@@ -576,8 +513,7 @@ readDosDirSection(int f, struct bootblock *boot, struct fatEntry *fat,
 							   empcl, empty - buffer,
 							   cl, p - buffer, 1) == FSFATAL)
 							return FSFATAL;
-						q = ((empcl == cl) ? empty : buffer);
-						assert(q != NULL);
+						q = empcl == cl ? empty : buffer;
 						for (; q < p; q += 32)
 							*q = SLOT_DELETED;
 						mod |= THISMOD|FSDIRMOD;
@@ -618,15 +554,6 @@ readDosDirSection(int f, struct bootblock *boot, struct fatEntry *fat,
 					vallfn = NULL;
 				}
 				lidx = *p & LRNOMASK;
-				if (lidx == 0) {
-					pwarn("invalid long name\n");
-					if (!invlfn) {
-						invlfn = vallfn;
-						invcl = valcl;
-					}
-					vallfn = NULL;
-					continue;
-				}
 				t = longName + --lidx * 13;
 				for (k = 1; k < 11 && t < longName +
 				    sizeof(longName); k += 2) {
@@ -894,36 +821,6 @@ readDosDirSection(int f, struct bootblock *boot, struct fatEntry *fat,
 						}
 					}
 					continue;
-				} else {
-					/*
-					 * Only one directory entry can point
-					 * to dir->head, it's '.'.
-					 */
-					if (dirent.head == dir->head) {
-						pwarn("%s entry in %s has incorrect start cluster\n",
-								dirent.name, fullpath(dir));
-						if (ask(1, "Remove")) {
-							*p = SLOT_DELETED;
-							mod |= THISMOD|FSDIRMOD;
-						} else
-							mod |= FSERROR;
-						continue;
-					} else if ((check_subdirectory(f, boot,
-					    &dirent) & FSERROR) == FSERROR) {
-						/*
-						 * A subdirectory should have
-						 * a dot (.) entry and a dot-dot
-						 * (..) entry of ATTR_DIRECTORY,
-						 * we will inspect further when
-						 * traversing into it.
-						 */
-						if (ask(1, "Remove")) {
-							*p = SLOT_DELETED;
-							mod |= THISMOD|FSDIRMOD;
-						} else
-							mod |= FSERROR;
-						continue;
-					}
 				}
 
 				/* create directory tree node */
@@ -1067,12 +964,10 @@ reconnect(int dosfs, struct bootblock *boot, struct fatEntry *fat, cl_t head)
 		if (lfcl < CLUST_FIRST || lfcl >= boot->NumClusters) {
 			/* Extend LOSTDIR?				XXX */
 			pwarn("No space in %s\n", LOSTDIR);
-			lfcl = (lostDir->head < boot->NumClusters) ? lostDir->head : 0;
 			return FSERROR;
 		}
-		lfoff = (lfcl - CLUST_FIRST) * boot->ClusterSize
-		    + boot->FirstCluster * boot->bpbBytesPerSec;
-
+		lfoff = lfcl * boot->ClusterSize
+		    + boot->ClusterOffset * boot->bpbBytesPerSec;
 		if (lseek(dosfs, lfoff, SEEK_SET) != lfoff
 		    || (size_t)read(dosfs, lfbuf, boot->ClusterSize) != boot->ClusterSize) {
 			perr("could not read LOST.DIR");
diff --git a/dosfs.h b/dosfs.h
index 9f1480f..3d84ea0 100644
--- a/dosfs.h
+++ b/dosfs.h
@@ -74,7 +74,7 @@ struct bootblock {
 	u_int32_t NumSectors;		/* how many sectors are there */
 	u_int32_t FATsecs;		/* how many sectors are in FAT */
 	u_int32_t NumFatEntries;	/* how many entries really are there */
-	u_int	FirstCluster;		/* at what sector is Cluster CLUST_FIRST */
+	u_int	ClusterOffset;		/* at what sector would sector 0 start */
 	u_int	ClusterSize;		/* Cluster size in bytes */
 
 	/* Now some statistics: */
diff --git a/fat.c b/fat.c
index 7ca81ab..9e4f5c8 100644
--- a/fat.c
+++ b/fat.c
@@ -54,10 +54,10 @@ static int _readfat(int, struct bootblock *, u_int, u_char **);
  * 31...... ........ ........ .......0
  * rrrr1111 11111111 11111111 mmmmmmmm         FAT32 entry 0
  * rrrrsh11 11111111 11111111 11111xxx         FAT32 entry 1
- *
+ * 
  *                   11111111 mmmmmmmm         FAT16 entry 0
  *                   sh111111 11111xxx         FAT16 entry 1
- *
+ * 
  * r = reserved
  * m = BPB media ID byte
  * s = clean flag (1 = dismounted; 0 = still mounted)
@@ -166,11 +166,11 @@ static int
 _readfat(int fs, struct bootblock *boot, u_int no, u_char **buffer)
 {
 	off_t off;
+	size_t len;
 
-	*buffer = calloc(boot->FATsecs, boot->bpbBytesPerSec);
+	*buffer = malloc(len = boot->FATsecs * boot->bpbBytesPerSec);
 	if (*buffer == NULL) {
-		perr("No space for FAT sectors (%zu)",
-		    (size_t)boot->FATsecs);
+		perr("No space for FAT sectors (%zu)", len);
 		return 0;
 	}
 
@@ -205,19 +205,20 @@ readfat(int fs, struct bootblock *boot, u_int no, struct fatEntry **fp)
 	u_char *buffer, *p;
 	cl_t cl;
 	int ret = FSOK;
+	size_t len;
 
 	boot->NumFree = boot->NumBad = 0;
 
 	if (!_readfat(fs, boot, no, &buffer))
 		return FSFATAL;
 
-	fat = calloc(boot->NumClusters, sizeof(struct fatEntry));
+	fat = malloc(len = boot->NumClusters * sizeof(struct fatEntry));
 	if (fat == NULL) {
-		perr("No space for FAT clusters (%zu)",
-		    (size_t)boot->NumClusters);
+		perr("No space for FAT clusters (%zu)", len);
 		free(buffer);
 		return FSFATAL;
 	}
+	(void)memset(fat, 0, len);
 
 	if (buffer[0] != boot->bpbMedia
 	    || buffer[1] != 0xff || buffer[2] != 0xff
@@ -518,6 +519,7 @@ clear:
 		}
 		if (head == fat[n].head) {
 			pwarn("Cluster chain starting at %u loops at cluster %u\n",
+
 			    head, p);
 			goto clear;
 		}
@@ -564,13 +566,12 @@ writefat(int fs, struct bootblock *boot, struct fatEntry *fat, int correct_fat)
 	off_t off;
 	int ret = FSOK;
 
-	fatsz = boot->FATsecs * boot->bpbBytesPerSec;
-	buffer = calloc(boot->FATsecs, boot->bpbBytesPerSec);
+	buffer = malloc(fatsz = boot->FATsecs * boot->bpbBytesPerSec);
 	if (buffer == NULL) {
-		perr("No space for FAT sectors (%zu)",
-		    (size_t)boot->FATsecs);
+		perr("No space for FAT sectors (%zu)", fatsz);
 		return FSFATAL;
 	}
+	memset(buffer, 0, fatsz);
 	boot->NumFree = 0;
 	p = buffer;
 	if (correct_fat) {
@@ -644,8 +645,8 @@ writefat(int fs, struct bootblock *boot, struct fatEntry *fat, int correct_fat)
 				break;
 			if (fat[cl].next == CLUST_FREE)
 				boot->NumFree++;
-			*p++ |= (u_char)(fat[cl].next << 4);
-			*p++ = (u_char)(fat[cl].next >> 4);
+			*p++ |= (u_char)(fat[cl + 1].next << 4);
+			*p++ = (u_char)(fat[cl + 1].next >> 4);
 			break;
 		}
 	}
@@ -704,20 +705,6 @@ checklost(int dosfs, struct bootblock *boot, struct fatEntry *fat)
 				ret = 1;
 			}
 		}
-		if (boot->FSNext != 0xffffffffU &&
-		    (boot->FSNext >= boot->NumClusters ||
-		    (boot->NumFree && fat[boot->FSNext].next != CLUST_FREE))) {
-			pwarn("Next free cluster in FSInfo block (%u) %s\n",
-			      boot->FSNext,
-			      (boot->FSNext >= boot->NumClusters) ? "invalid" : "not free");
-			if (ask(1, "fix"))
-				for (head = CLUST_FIRST; head < boot->NumClusters; head++)
-					if (fat[head].next == CLUST_FREE) {
-						boot->FSNext = head;
-						ret = 1;
-						break;
-					}
-		}
 		if (ret)
 			mod |= writefsinfo(dosfs, boot);
 	}