libblkid: befs: fix possible load of misaligned address

The misaligned uint16_t loads can come only form a corrupt metadata.

Found by OSS-Fuzz by cryptsetup project fuzzers (issue 507641687).

Signed-off-by: Milan Broz <gmazyland@gmail.com>

diff --git a/libblkid/src/superblocks/befs.c b/libblkid/src/superblocks/befs.c
index a7a9d30a964fadb538745faceb75a6df7912ce11..1e0550cb0d17550a73628bf1b2ae52bcfde9f98b 100644 (file)
--- a/libblkid/src/superblocks/befs.c
+++ b/libblkid/src/superblocks/befs.c
@@ -329,6 +329,10 @@ static int64_t get_key_value(blkid_probe pr, const struct befs_super_block *bs,
                keylengths = (uint16_t *) ((uint8_t *) bn + keylengths_offset);
                values = (int64_t *) ((uint8_t *) bn + values_offset);
 
+                /* Misaligned offset comes only from corrupt metadata. */
+               if ((uintptr_t) keylengths % sizeof(*keylengths))
+                       return -ENOENT; /* Corrupt? */
+
                first = 0;
                mid = 0;
                last = all_key_count - 1;