From 017367c1146a69baca6a1a0bea10b0cb02c72d85 Mon Sep 17 00:00:00 2001 From: Konstantin Belousov Date: Tue, 25 Oct 2022 00:34:15 +0300 Subject: [PATCH] ffs validate_sblock(): avoid 32bit mul overflow Reported by: soralx@cydem.org Tested by: pho Reviewed by: mckusick Sponsored by: The FreeBSD Foundation MFC after: 1 week --- sys/ufs/ffs/ffs_subr.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sys/ufs/ffs/ffs_subr.c b/sys/ufs/ffs/ffs_subr.c index e804dfa3d33..b6b0be56fc7 100644 --- a/sys/ufs/ffs/ffs_subr.c +++ b/sys/ufs/ffs/ffs_subr.c @@ -546,8 +546,8 @@ validate_sblock(struct fs *fs, int flags) * and ends in the data area of the same cylinder group. */ FCHK(fs->fs_size, <, 8 * fs->fs_frag, %jd); - FCHK(fs->fs_size, <=, (fs->fs_ncg - 1) * fs->fs_fpg, %jd); - FCHK(fs->fs_size, >, fs->fs_ncg * fs->fs_fpg, %jd); + FCHK(fs->fs_size, <=, ((int64_t)fs->fs_ncg - 1) * fs->fs_fpg, %jd); + FCHK(fs->fs_size, >, (int64_t)fs->fs_ncg * fs->fs_fpg, %jd); /* * If we are not requested to read in the csum data stop here * as the correctness of the remaining values is only important