As @oscarjhk reported:
When tar-index mode is used, the inode chunk count will be calculated
as 0 if a crafted GNU base-256 size is UINT64_MAX, which will cause
a heap out-of-bounds write.
Fixes: 95d315fd7958 ("erofs-utils: introduce tarerofs")
Signed-off-by: Gao Xiang <[email protected]>
---
lib/blobchunk.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/lib/blobchunk.c b/lib/blobchunk.c
index 0523873570a2..5e0fb70be687 100644
--- a/lib/blobchunk.c
+++ b/lib/blobchunk.c
@@ -507,7 +507,9 @@ int tarerofs_write_chunkes(struct erofs_inode *inode,
erofs_off_t data_offset)
datablob_size += round_up(inode->i_size, erofs_blksiz(sbi));
}
chunksize = 1ULL << chunkbits;
- count = DIV_ROUND_UP(inode->i_size, chunksize);
+ /* e.g. DIV_ROUND_UP(UINT64_MAX, 1 TiB) can overflow */
+ count = (inode->i_size >> chunkbits) +
+ !!(inode->i_size & (chunksize - 1));
inode->extent_isize = count * unit;
idx = calloc(count, max(sizeof(*idx), sizeof(void *)));
--
2.43.5
