From: Jeroen Oortwijn Date: Tue, 9 Mar 2010 22:15:30 +0000 (+0100) Subject: libblkid: prevent overflow in BeFS X-Git-Url: https://err.no/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=af109b063aa15866a0570920586d79417d7a7a67;p=util-linux libblkid: prevent overflow in BeFS Prevent overflow by casting values to blkid_loff_t before applying block shift. Signed-off-by: Jeroen Oortwijn --- diff --git a/shlibs/blkid/src/superblocks/befs.c b/shlibs/blkid/src/superblocks/befs.c index b341402a..c238bae3 100644 --- a/shlibs/blkid/src/superblocks/befs.c +++ b/shlibs/blkid/src/superblocks/befs.c @@ -123,13 +123,13 @@ static int probe_befs(blkid_probe pr, const struct blkid_idmag *mag) return -1; bi = (struct befs_inode *) blkid_probe_get_buffer(pr, - (FS32_TO_CPU(bs->root_dir.allocation_group, fs_le) - << FS32_TO_CPU(bs->ag_shift, fs_le) - << FS32_TO_CPU(bs->block_shift, fs_le)) - + (FS16_TO_CPU(bs->root_dir.start, fs_le) - << FS32_TO_CPU(bs->block_shift, fs_le)), - FS16_TO_CPU(bs->root_dir.len, fs_le) - << FS32_TO_CPU(bs->block_shift, fs_le)); + ((blkid_loff_t)FS32_TO_CPU(bs->root_dir.allocation_group, fs_le) + << FS32_TO_CPU(bs->ag_shift, fs_le) + << FS32_TO_CPU(bs->block_shift, fs_le)) + + ((blkid_loff_t)FS16_TO_CPU(bs->root_dir.start, fs_le) + << FS32_TO_CPU(bs->block_shift, fs_le)), + (blkid_loff_t)FS16_TO_CPU(bs->root_dir.len, fs_le) + << FS32_TO_CPU(bs->block_shift, fs_le)); if (!bi) return -1;