rt/snapraid
1
0
Fork 0
mirror of https://github.com/amadvance/snapraid.git synced 2026-10-26 10:51:54 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix integer overflow in deleted block count byte size conversion in content parser

Browse source
This commit is contained in:
Andrea Mazzoleni 2026-08-27 17:38:07 +02:00
parent 39e810564f
commit b5cc5eb007
1 changed files with 9 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

9
cmdline/state.c
View file

@ -2677,6 +2677,15 @@ static void state_read_content(struct snapraid_state* state, const char* path, S
case 'o' :
/* if it's a run of deleted blocks */
/* ensure the converted byte size fits in signed data_off_t without overflow */
if (v_count > INT64_MAX / (uint64_t)state->block_size) {
/* LCOV_EXCL_START */
decoding_error(path, f);
log_fatal(ECONTENT, "Internal inconsistency: Invalid deleted block count %" PRIu64 "!\n", v_count);
exit(EXIT_FAILURE);
/* LCOV_EXCL_STOP */
}
/* allocate a fake deleted file */
deleted = file_alloc(state->block_size, "<deleted>", v_count * (data_off_t)state->block_size, 0, 0, 0, 0);