From 95ac8d7b519e8c5e1919ef2d557400bc75b65e6c Mon Sep 17 00:00:00 2001 From: Andrea Mazzoleni Date: Wed, 26 Aug 2026 22:26:35 +0200 Subject: [PATCH] Validate serialized nanoseconds range when reading content files --- cmdline/state.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/cmdline/state.c b/cmdline/state.c index 1f90e791..b64bd3ff 100644 --- a/cmdline/state.c +++ b/cmdline/state.c @@ -2370,7 +2370,7 @@ static void state_read_content(struct snapraid_state* state, const char* path, S } ret = sgetb32(f, &v_mtime_nsec); - if (ret < 0) { + if (ret < 0 || v_mtime_nsec > 1000000000) { /* LCOV_EXCL_START */ decoding_error(path, f); os_abort(); @@ -2808,7 +2808,7 @@ static void state_read_content(struct snapraid_state* state, const char* path, S } ret = sgetb32(f, &v_mtime_nsec); - if (ret < 0) { + if (ret < 0 || v_mtime_nsec > 1000000000) { /* LCOV_EXCL_START */ decoding_error(path, f); os_abort();