From b5cc5eb007d2dd29e4ef0416a8b0ec86e304a78d Mon Sep 17 00:00:00 2001
From: Andrea Mazzoleni <amadvance@gmail.com>
Date: Thu, 27 Aug 2026 17:38:07 +0200
Subject: [PATCH] Fix integer overflow in deleted block count byte size
 conversion in content parser

---
 cmdline/state.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/cmdline/state.c b/cmdline/state.c
index 871f57a9..31e8c191 100644
--- a/cmdline/state.c
+++ b/cmdline/state.c
@@ -2677,6 +2677,15 @@ static void state_read_content(struct snapraid_state* state, const char* path, S
 				case 'o' :
 					/* if it's a run of deleted blocks */
 
+					/* ensure the converted byte size fits in signed data_off_t without overflow */
+					if (v_count > INT64_MAX / (uint64_t)state->block_size) {
+						/* LCOV_EXCL_START */
+						decoding_error(path, f);
+						log_fatal(ECONTENT, "Internal inconsistency: Invalid deleted block count %" PRIu64 "!\n", v_count);
+						exit(EXIT_FAILURE);
+						/* LCOV_EXCL_STOP */
+					}
+
 					/* allocate a fake deleted file */
 					deleted = file_alloc(state->block_size, "<deleted>", v_count * (data_off_t)state->block_size, 0, 0, 0, 0);