36 lines
1.3 KiB
Diff
36 lines
1.3 KiB
Diff
From 665ac314c3f16afd1f1ed247b96e9136452ddd9e Mon Sep 17 00:00:00 2001
|
|
From: Milan Broz <gmazyland@gmail.com>
|
|
Date: Sun, 4 Jun 2023 19:15:55 +0200
|
|
Subject: [PATCH] libblkid: jfs - avoid undefined shift
|
|
|
|
Fix previous commit 04a0717b0b0faa1a8078dc6fad05183b8bada395
|
|
to avoid undefined shift if value is exactly 32.
|
|
|
|
libblkid/src/superblocks/jfs.c:46:39: runtime error:
|
|
shift exponent 32 is too large for 32-bit type 'unsigned int'
|
|
|
|
Reproducer found with OSS-Fuzz (issue 59284) running over
|
|
cryptsetup project (blkid is used in header init).
|
|
|
|
Signed-off-by: Milan Broz <gmazyland@gmail.com>
|
|
---
|
|
libblkid/src/superblocks/jfs.c | 2 ++
|
|
1 file changed, 2 insertions(+)
|
|
|
|
diff --git a/libblkid/src/superblocks/jfs.c b/libblkid/src/superblocks/jfs.c
|
|
index 3de8c2e..bf03b21 100644
|
|
--- a/libblkid/src/superblocks/jfs.c
|
|
+++ b/libblkid/src/superblocks/jfs.c
|
|
@@ -41,6 +41,8 @@ static int probe_jfs(blkid_probe pr, const struct blkid_idmag *mag)
|
|
js = blkid_probe_get_sb(pr, mag, struct jfs_super_block);
|
|
if (!js)
|
|
return errno ? -errno : 1;
|
|
+ if (le16_to_cpu(js->js_l2bsize) > 31 || le16_to_cpu(js->js_l2pbsize) > 31)
|
|
+ return 1;
|
|
if (le32_to_cpu(js->js_bsize) != (1U << le16_to_cpu(js->js_l2bsize)))
|
|
return 1;
|
|
if (le32_to_cpu(js->js_pbsize) != (1U << le16_to_cpu(js->js_l2pbsize)))
|
|
--
|
|
2.33.0
|
|
|