]> git.ipfire.org Git - thirdparty/util-linux.git/commitdiff
libblkid: Fix type access in zfs_extract_guid_name
authorTobias Stoeckmann <tobias@stoeckmann.org>
Wed, 8 Apr 2026 19:56:03 +0000 (21:56 +0200)
committerTobias Stoeckmann <tobias@stoeckmann.org>
Wed, 8 Apr 2026 19:56:03 +0000 (21:56 +0200)
Check if enough space is left for a 32 bit value before parsing it. This
is not a technical out of boundary issue, because due to alignment,
enough bytes are available.

Yet, perform a proper logic check here.

Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
libblkid/src/superblocks/zfs.c

index 0bec21d9de45ddb9683f5204accca073f067d4bc..025110af6969268b6eb0562966e7d8a77b7c0ea9 100644 (file)
@@ -223,7 +223,7 @@ static bool zfs_extract_guid_name(blkid_probe pr, void *buf, size_t size, bool f
                                       size, nvp_size));
 
                /* nvpair fits in buffer and name fits in nvpair? */
-               if (nvp_size > size || namesize + sizeof(*nvp) > nvp_size)
+               if (nvp_size > size || namesize + sizeof(*nvp) + 4 > nvp_size)
                        return (false);
 
                DBG(LOWPROBE,