static-delta: validate bspatch payload offset and length

Origin: https://github.com/ostreedev/ostree/pull/3647
Applied-upstream: 2026.5, commit:84ca25e8a09da15fb96b81e87a5778b6db7dd05f

Gbp-Pq: Name static-delta-validate-bspatch-payload-offset-and-length.patch

diff --git a/src/libostree/ostree-repo-static-delta-processing.c b/src/libostree/ostree-repo-static-delta-processing.c
index 5fcec2deca3a8ae3a86795e2c9e1c839c32384b8..99a87c6710a81e2d617035c0953a49191820ef6e 100644 (file)
--- a/src/libostree/ostree-repo-static-delta-processing.c
+++ b/src/libostree/ostree-repo-static-delta-processing.c
@@ -403,6 +403,8 @@ dispatch_bspatch (OstreeRepo *repo, StaticDeltaExecutionState *state, GCancellab
     return FALSE;
   if (!read_varuint64 (state, &length, error))
     return FALSE;
+  if (!validate_ofs (state, offset, length, error))
+    return FALSE;
 
   if (state->stats_only)
     return TRUE; /* Early return */