SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

dissect-image: prevent start+size LBA overflow

Browse Source
This commit is contained in:
zouge666
2026-09-21 10:10:22 +02:00
committed by Lennart Poettering
parent e96ff3b5b9
commit 07cf0376a8
1 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/shared/dissect-image.c
+7 -2
View File
@@ -1309,7 +1309,7 @@ static int dissect_image(
start = sym_blkid_partition_get_start(pp);
if (start < 0)
return errno_or_else(EIO);
if ((uint64_t) start >= UINT64_MAX/512)
if ((uint64_t) start > INT64_MAX / 512)
return log_debug_errno(SYNTHETIC_ERRNO(EOVERFLOW),
"Partition start LBA too large to convert to a byte offset, refusing.");
@@ -1317,10 +1317,15 @@ static int dissect_image(
size = sym_blkid_partition_get_size(pp);
if (size < 0)
return errno_or_else(EIO);
if ((uint64_t) size >= UINT64_MAX/512)
if ((uint64_t) size > INT64_MAX / 512)
return log_debug_errno(SYNTHETIC_ERRNO(EOVERFLOW),
"Partition size in LBA too large to convert to a byte offset, refusing.");
/* Ensure the partition's exclusive end LBA can be converted to a byte offset. */
if ((uint64_t) start + (uint64_t) size > INT64_MAX / 512)
return log_debug_errno(SYNTHETIC_ERRNO(EOVERFLOW),
"Partition end LBA too large to convert to a byte offset, refusing.");
/* While probing we need the non-diskseq device node name to access the thing, hence mask off
* DISSECT_IMAGE_DISKSEQ_DEVNODE. */
r = make_partition_devname(devname, diskseq, nr, flags & ~DISSECT_IMAGE_DISKSEQ_DEVNODE, &node);