From: Karel Zak <kzak@redhat.com>
Date: Wed, 15 Apr 2026 18:31:19 +0000 (+0200)
Subject: libblkid: udf: avoid 32-bit overflow in offset calculations
X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=ae818dc1b5b0f205f29dcd65d0baf2082b809b7b;p=thirdparty%2Futil-linux.git

libblkid: udf: avoid 32-bit overflow in offset calculations

Signed-off-by: Karel Zak <kzak@redhat.com>
---

diff --git a/libblkid/src/superblocks/udf.c b/libblkid/src/superblocks/udf.c
index a04da63a3..b1dac96b0 100644
--- a/libblkid/src/superblocks/udf.c
+++ b/libblkid/src/superblocks/udf.c
@@ -162,7 +162,7 @@ struct logical_vol_integ_descriptor_imp_use
 	uint16_t	max_udf_write_rev;
 } __attribute__ ((packed));
 
-#define UDF_LVIDIU_OFFSET(vd) (sizeof((vd).tag) + sizeof((vd).type.logical_vol_integ) + 2 * 4 * le32_to_cpu((vd).type.logical_vol_integ.num_partitions))
+#define UDF_LVIDIU_OFFSET(vd) (sizeof((vd).tag) + sizeof((vd).type.logical_vol_integ) + (uint64_t) 8 * le32_to_cpu((vd).type.logical_vol_integ.num_partitions))
 #define UDF_LVIDIU_LENGTH(vd) (le32_to_cpu((vd).type.logical_vol_integ.imp_use_length))
 
 static inline int gen_uuid_from_volset_id(unsigned char uuid[17], struct dstring128 *volset_id)
@@ -362,7 +362,7 @@ real_blksz:
 	for (b = 0; b < count; b++) {
 		vd = (struct volume_descriptor *)
 			blkid_probe_get_buffer(pr,
-					(uint64_t) (loc + b) * bs,
+					((uint64_t) loc + b) * bs,
 					sizeof(*vd));
 		if (!vd)
 			return errno ? -errno : 1;