From cef0631a8d2dcff76aad279323dbe0a6364ff7b0 Mon Sep 17 00:00:00 2001 From: Siteshwar Vashisht Date: Wed, 9 Sep 2026 11:14:42 +0200 Subject: [PATCH] btrfs-util: validate that `sh.len` is large enough ... to contain the `struct btrfs_chunk` header and all declared stripes before using `num_stripes` as a loop bound. --- src/shared/btrfs-util.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/src/shared/btrfs-util.c b/src/shared/btrfs-util.c index 780c1be349..f03eab91fd 100644 --- a/src/shared/btrfs-util.c +++ b/src/shared/btrfs-util.c @@ -1947,11 +1947,21 @@ static int btrfs_read_chunk_tree_fd(int fd, BtrfsChunkTree *ret) { if (sh.type != BTRFS_CHUNK_ITEM_KEY) continue; + if (sh.len < sizeof(struct btrfs_chunk)) + return -EBADMSG; + chunk = new(BtrfsChunk, 1); if (!chunk) return -ENOMEM; const struct btrfs_chunk *item = body; + + if (le16toh(item->num_stripes) == 0 || le64toh(item->stripe_len) == 0) + return -EBADMSG; + + if ((sh.len - sizeof(struct btrfs_chunk)) / sizeof(struct btrfs_stripe) + 1 < le16toh(item->num_stripes)) + return -EBADMSG; + *chunk = (BtrfsChunk) { .offset = sh.offset, .length = le64toh(item->length),