]> git.ipfire.org Git - thirdparty/util-linux.git/commit
libblkid: fix integer overflows in HFS+ offset calculations
authorKarel Zak <kzak@redhat.com>
Wed, 25 Feb 2026 09:21:56 +0000 (10:21 +0100)
committerKarel Zak <kzak@redhat.com>
Wed, 25 Feb 2026 09:21:56 +0000 (10:21 +0100)
commite589e409b7fa3ecd6b0baeed7660edbf5f93bb65
treea2b7d0c26a267324baeba0e6646580a7fe9a996f
parenteda846192f80947a4367029261dedb06dc3a6aae
libblkid: fix integer overflows in HFS+ offset calculations

Two 32-bit multiplications using on-disk values can overflow:

 - leaf_node_head (uint32_t) * leaf_node_size (uint16_t) used to
   calculate leaf_block; overflow produces a wrong block number,
   causing reads from incorrect offsets.

 - embed_first_block (uint16_t) * alloc_block_size (uint32_t) used to
   calculate the embedded HFS+ volume offset; overflow truncates the
   result, again causing reads from wrong offsets.

Fix by widening leaf_block and off to uint64_t and casting
multiplication operands.  Bogus results from crafted images are then
safely rejected by blkid_probe_get_buffer() bounds checking and
the extent loop exhaustion.

Signed-off-by: Karel Zak <kzak@redhat.com>
libblkid/src/superblocks/hfs.c