git: 818243722f6e - stable/14 - cd9660: Add length checks to Rock Ridge parser

The branch stable/14 has been updated by des:

URL: https://cgit.FreeBSD.org/src/commit/?id=818243722f6ef4e08bff05a7d3f38984fb758506

commit 818243722f6ef4e08bff05a7d3f38984fb758506
Author:     Dag-Erling Smørgrav <des@FreeBSD.org>
AuthorDate: 2026-04-01 17:14:16 +0000
Commit:     Dag-Erling Smørgrav <des@FreeBSD.org>
CommitDate: 2026-04-07 15:52:41 +0000

    cd9660: Add length checks to Rock Ridge parser
    
    * cd9660_rrip_slink() did not check that the lengths of individual
      entries do not exceed the length of the overall record.
    
    * cd9660_rrip_altname() did not check that the length of the record
      was at least 5 before subtracting 5 from it.
    
    Note that in both cases, a better solution would be to check the length
    of the data before calling the handler, or immediately upon entry of
    the handler, but this would require significant refactoring.
    
    MFC after:      1 week
    Reported by:    Calif.io in collaboration with Claude and Anthropic Research
    Reported by:    Adam Crosser, Praetorian
    Reviewed by:    markj
    Differential Revision:  https://reviews.freebsd.org/D56215
    
    (cherry picked from commit d0afead876076f605c363f03d92304d1bd75be1c)
---
 sys/fs/cd9660/cd9660_rrip.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/sys/fs/cd9660/cd9660_rrip.c b/sys/fs/cd9660/cd9660_rrip.c
index d3b8ccab16ae..28bf7fd3a097 100644
--- a/sys/fs/cd9660/cd9660_rrip.c
+++ b/sys/fs/cd9660/cd9660_rrip.c
@@ -178,6 +178,8 @@ cd9660_rrip_slink(ISO_RRIP_SLINK *p, ISO_RRIP_ANALYZE *ana)
 			/* Inserting component */
 			wlen = isonum_711(pcomp->clen);
 			inbuf = pcomp->name;
+			if (inbuf + wlen > (char *)pcompe)
+				wlen = ana->maxlen + 1;
 			break;
 		default:
 			printf("RRIP with incorrect flags?");
@@ -249,6 +251,8 @@ cd9660_rrip_altname(ISO_RRIP_ALTNAME *p, ISO_RRIP_ANALYZE *ana)
 		/* Inserting component */
 		wlen = isonum_711(p->h.length) - 5;
 		inbuf = (char *)p + 5;
+		if (wlen < 0)
+			wlen = ana->maxlen + 1;
 		break;
 
 	default: