From d096763827718083918244eb3b7796bf27876d56 Mon Sep 17 00:00:00 2001
From: Mikhail Nogin <joycap@altlinux.org>
Date: Mon, 25 May 2026 17:07:57 +0300
Subject: [PATCH] dissect-image: reject empty partitions array

di is allocated while iterating over p.partitions. If the array is
empty,
the loop is skipped and di remains NULL, but the code still assigns
image
metadata through it.

Return EBADMSG before accessing di in this case.

Found by Linux Verification Center (linuxtesting.org) with Svace.
---
 src/shared/dissect-image.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/shared/dissect-image.c b/src/shared/dissect-image.c
index e00dce3fbd..b3423dd97d 100644
--- a/src/shared/dissect-image.c
+++ b/src/shared/dissect-image.c
@@ -5298,6 +5298,9 @@ int mountfsd_mount_image_fd(
                 };
         }
 
+        if (!di)
+                return log_debug_errno(SYNTHETIC_ERRNO(EBADMSG), "Partition list is empty.");
+
         di->single_file_system = p.single_file_system;
         di->image_size = p.image_size;
         di->sector_size = p.sector_size;