Impact: A malicious file system may cause unexpected system shutdown Description: A NULL dereference issue existed in the handling of HFS filenames. A maliciously crafted filesystem may cause an unexpected system shutdown. This issue was addressed by avoiding the NULL dereference. MACOSX 10.9 CODE: http://opensource.apple.com/source/xnu/xnu-2422.1.72/bsd/hfs/hfs_vfsops.c ------------------- MALLOC(filename, char *, newlen, M_TEMP, M_WAITOK); if (filename == NULL) { error = ENOMEM; goto encodinghint_exit; } MALLOC(unicode_name, u_int16_t *, bufsize, M_TEMP, M_WAITOK); if (filename == NULL) { <======== error = ENOMEM; goto encodinghint_exit; ------------------- MACOSX 10.10 CODE: http://opensource.apple.com/source/xnu/xnu-2782.1.97/bsd/hfs/hfs_vfsops.c ------------------- MALLOC(filename, char *, newlen, M_TEMP, M_WAITOK); if (filename == NULL) { error = ENOMEM; goto encodinghint_exit; } MALLOC(unicode_name, u_int16_t *, bufsize, M_TEMP, M_WAITOK); if (unicode_name == NULL) { error = ENOMEM; goto encodinghint_exit; } ------------------- Vulnerability discovered by tool cifrex.org for static code analysis More: http://cxsecurity.com/issue/WLB-2014040027