From 0fc76c839c5b3a5d69e8ef6aef85e1a38fe988ba Mon Sep 17 00:00:00 2001 From: Zibran Khan Date: Wed, 19 Aug 2026 19:33:11 +0530 Subject: [PATCH] static-delta: validate bspatch payload offset and length Origin: https://github.com/ostreedev/ostree/pull/3647 Applied-upstream: 2026.5, commit:84ca25e8a09da15fb96b81e87a5778b6db7dd05f Gbp-Pq: Name static-delta-validate-bspatch-payload-offset-and-length.patch --- src/libostree/ostree-repo-static-delta-processing.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/libostree/ostree-repo-static-delta-processing.c b/src/libostree/ostree-repo-static-delta-processing.c index 5fcec2de..99a87c67 100644 --- a/src/libostree/ostree-repo-static-delta-processing.c +++ b/src/libostree/ostree-repo-static-delta-processing.c @@ -403,6 +403,8 @@ dispatch_bspatch (OstreeRepo *repo, StaticDeltaExecutionState *state, GCancellab return FALSE; if (!read_varuint64 (state, &length, error)) return FALSE; + if (!validate_ofs (state, offset, length, error)) + return FALSE; if (state->stats_only) return TRUE; /* Early return */ -- 2.39.5