From 7930ff82dff1207fe7569d0f7f4594ec5a52025b Mon Sep 17 00:00:00 2001
From: Andrea Mazzoleni <amadvance@gmail.com>
Date: Thu, 27 Aug 2026 16:21:35 +0200
Subject: [PATCH] Validate serialized disk mapping positions to prevent integer
 overflow and out-of-bounds access

---
 cmdline/state.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/cmdline/state.c b/cmdline/state.c
index d3e08745..871f57a9 100644
--- a/cmdline/state.c
+++ b/cmdline/state.c
@@ -3163,6 +3163,14 @@ static void state_read_content(struct snapraid_state* state, const char* path, S
 				/* LCOV_EXCL_STOP */
 			}
 
+			if (v_idx >= RAID_DATA_MAX) {
+				/* LCOV_EXCL_START */
+				decoding_error(path, f);
+				log_fatal(ECONTENT, "Invalid disk position '%u' in the content file!\n", v_idx);
+				exit(EXIT_FAILURE);
+				/* LCOV_EXCL_STOP */
+			}
+
 			/* from SnapRAID 7.0 the 'M' command includes the free space */
 			if (c == 'M') {
 				ret = sgetb64(f, &v_total_blocks);