From 106cd7cb5d0896b4606ad14453fd6036306968fa Mon Sep 17 00:00:00 2001 From: Kou Wenqi Date: Fri, 23 Oct 2026 17:13:47 +0800 Subject: [PATCH] btrfs: fix integer overflow in bd_btrfs_create_volume argument counter bd_btrfs_create_volume() used guint8 for both num_args and next_arg when constructing the mkfs.btrfs argv array. When the number of input devices combined with optional parameters (label, data_level, md_level) exceeded 255, the 8-bit counter wrapped around to a much smaller value, causing g_new0() to allocate a buffer far too small for the actual number of arguments. The subsequent argv population then wrote past the allocated boundary, corrupting heap metadata and potentially leading to arbitrary code execution. Fix it by widening num_args and next_arg from guint8 to guint, which provides a 32-bit range sufficient for any realistic argument count. Signed-off-by: Kou Wenqi --- src/plugins/btrfs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/plugins/btrfs.c b/src/plugins/btrfs.c index 197a96fe..8436dc36 100644 --- a/src/plugins/btrfs.c +++ b/src/plugins/btrfs.c @@ -314,9 +314,9 @@ static BDBtrfsFilesystemInfo* get_filesystem_info_from_match (GMatchInfo *match_ */ gboolean bd_btrfs_create_volume (const gchar **devices, const gchar *label, const gchar *data_level, const gchar *md_level, const BDExtraArg **extra, GError **error) { const gchar **device_p = NULL; - guint8 num_args = 0; + guint num_args = 0; const gchar **argv = NULL; - guint8 next_arg = 1; + guint next_arg = 1; gboolean success = FALSE; if (!check_deps (&avail_deps, DEPS_BTRFS_MASK, deps, DEPS_LAST, &deps_check_lock, error) ||