diff mbox series

[4/4] blkid: probe_exfat: clamp untrusted label->length to valid size

Message ID 20260924210421.3631790-5-sandeen@redhat.com
State New
Headers show
Series e2fsprogs: blkid: misc fixes | expand

Commit Message

Eric Sandeen Sept. 24, 2026, 9:02 p.m. UTC 
From: Eric Sandeen <esandeen@redhat.com>

A corrupted or invalid label->length in an exfat filesystem may cause
probing to read past the end of label->name. Limit it in the same manner
as util-linux uses, and add a min() macro here to match.

Signed-off-by: Eric Sandeen <sandeen@redhat.com>
---
 lib/blkid/probe.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/lib/blkid/probe.c b/lib/blkid/probe.c
index 87167171..c371acea 100644
--- a/lib/blkid/probe.c
+++ b/lib/blkid/probe.c
@@ -38,6 +38,8 @@ 
 #include "uuid/uuid.h"
 #include "probe.h"
 
+#define min(a, b) ((a) < (b) ? (a) : (b))
+
 static int figure_label_len(const unsigned char *label, int len)
 {
 	const unsigned char *end = label + len - 1;
@@ -1535,7 +1537,8 @@  static int probe_exfat(struct blkid_probe *probe,
     label = find_exfat_entry_label(probe, sb);
     if (label) {
         unsigned char utf8_label[128];
-        unicode_16le_to_utf8(utf8_label, sizeof(utf8_label), label->name, label->length * 2);
+        unicode_16le_to_utf8(utf8_label, sizeof(utf8_label), label->name,
+		min((size_t) label->length * 2, sizeof(label->name)));
         blkid_set_tag(probe->dev, "LABEL", (char *) utf8_label, 0);
     } else {
         blkid_set_tag(probe->dev, "LABEL", "disk", 4);