From: Tobias Stoeckmann Date: Wed, 8 Apr 2026 19:56:03 +0000 (+0200) Subject: libblkid: Fix type access in zfs_extract_guid_name X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f16a0cf2f82c0703ef5b472f8714668edfd21eb9;p=thirdparty%2Futil-linux.git libblkid: Fix type access in zfs_extract_guid_name Check if enough space is left for a 32 bit value before parsing it. This is not a technical out of boundary issue, because due to alignment, enough bytes are available. Yet, perform a proper logic check here. Signed-off-by: Tobias Stoeckmann --- diff --git a/libblkid/src/superblocks/zfs.c b/libblkid/src/superblocks/zfs.c index 0bec21d9d..025110af6 100644 --- a/libblkid/src/superblocks/zfs.c +++ b/libblkid/src/superblocks/zfs.c @@ -223,7 +223,7 @@ static bool zfs_extract_guid_name(blkid_probe pr, void *buf, size_t size, bool f size, nvp_size)); /* nvpair fits in buffer and name fits in nvpair? */ - if (nvp_size > size || namesize + sizeof(*nvp) > nvp_size) + if (nvp_size > size || namesize + sizeof(*nvp) + 4 > nvp_size) return (false); DBG(LOWPROBE,