From 4f6ce566e16ead262f49b0ca18b87b933486cdc6 Mon Sep 17 00:00:00 2001 From: Paul Meyer Date: Sat, 13 Jun 2026 11:24:13 +0200 Subject: [PATCH] vmspawn: reject oversized fstab.extra credential before int-cast merge MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The fstab.extra merge prepends the existing credential via asprintf("%.*s", (int) existing->size, …). MachineCredential.size is size_t, so for a credential >INT_MAX the (int) cast yields a negative precision, which C treats as omitted — turning %.*s into an unbounded read past the allocation. Reject such a credential up front with EFBIG; for all realistic sizes the merge is unchanged. Co-developed-by: Claude Opus 4.8 Signed-off-by: Paul Meyer --- src/vmspawn/vmspawn.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/vmspawn/vmspawn.c b/src/vmspawn/vmspawn.c index 70dcc9914a..55c650af1b 100644 --- a/src/vmspawn/vmspawn.c +++ b/src/vmspawn/vmspawn.c @@ -3305,6 +3305,11 @@ static int run_virtual_machine(int kvm_device_fd, int vhost_device_fd) { if (existing) { _cleanup_free_ char *combined = NULL; + if (existing->size >= INT_MAX) + return log_error_errno(SYNTHETIC_ERRNO(EFBIG), + "Existing fstab.extra credential is too large (%zu bytes).", + existing->size); + if (existing->size > 0 && existing->data[existing->size - 1] != '\n') r = asprintf(&combined, "%.*s\n%s", (int) existing->size, existing->data, fstab_extra); else