libblkid: befs: fix possible too large shift

The existing guard needs to be evaluated as uint64_t otherwise
it wraps around.

Found by OSS-Fuzz by cryptsetup project fuzzers (issue 507641687).

Signed-off-by: Milan Broz <gmazyland@gmail.com>

diff --git a/libblkid/src/superblocks/befs.c b/libblkid/src/superblocks/befs.c
index e8005ffe628768256df082151f46ddb0361bbfcf..a7a9d30a964fadb538745faceb75a6df7912ce11 100644 (file)
--- a/libblkid/src/superblocks/befs.c
+++ b/libblkid/src/superblocks/befs.c
@@ -519,7 +519,7 @@ static int probe_befs(blkid_probe pr, const struct blkid_idmag *mag)
 
        /* get_block_run() shifts uint64 left by ag_shift + block_shift,
         * so the combined value must stay below 64 to avoid UB */
-       if (FS32_TO_CPU(bs->ag_shift, fs_le) + block_shift >= 64)
+       if ((uint64_t)FS32_TO_CPU(bs->ag_shift, fs_le) + block_shift >= 64)
                return BLKID_PROBE_NONE;
 
        ret = get_uuid(pr, bs, &volume_id, fs_le);