michael/u-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fs: prevent integer overflow in zfs_nvlist_lookup

Browse Source 
An integer overflow in nvlist size calculation could lead
to under-allocation and heap buffer overflow.

Signed-off-by: Timo tp Preißl <t.preissl@proton.me>
Reviewed-by: Simon Glass <simon.glass@canonical.com>
Reviewed-by: Tom Rini <trini@konsulko.com>
This commit is contained in:
Timo tp Preißl
2026-01-09 11:24:51 +00:00
committed by Tom Rini
parent 99416665f0
commit c8f0294285
1 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
fs/zfs/zfs.c
View File

@@ -1617,6 +1617,7 @@ zfs_nvlist_lookup_nvlist(char *nvlist, char *name)
char *ret;
size_t size;
int found;
size_t alloc;
found = nvlist_find_value(nvlist, name, DATA_TYPE_NVLIST, &nvpair,
&size, 0);
@@ -1627,7 +1628,10 @@ zfs_nvlist_lookup_nvlist(char *nvlist, char *name)
* nvlist to hold the encoding method, and two zero uint32's after the
* nvlist as the NULL terminator.
*/
ret = calloc(1, size + 3 * sizeof(uint32_t));
if (__builtin_add_overflow(size, 3 * sizeof(uint32_t), &alloc))
return 0;
ret = calloc(1, alloc);
if (!ret)
return 0;
memcpy(ret, nvlist, sizeof(uint32_t));