git: b3bf8410a562 - stable/13 - cd9660: Add length checks to Rock Ridge parser

The branch stable/13 has been updated by des:

URL: https://cgit.FreeBSD.org/src/commit/?id=b3bf8410a56260bc0f26b5197b3c8764f3283e9d

commit b3bf8410a56260bc0f26b5197b3c8764f3283e9d
Author:     Dag-Erling Smørgrav <des@FreeBSD.org>
AuthorDate: 2026-04-01 17:14:16 +0000
Commit:     Dag-Erling Smørgrav <des@FreeBSD.org>
CommitDate: 2026-04-07 15:52:56 +0000

    cd9660: Add length checks to Rock Ridge parser
    
    * cd9660_rrip_slink() did not check that the lengths of individual
      entries do not exceed the length of the overall record.
    
    * cd9660_rrip_altname() did not check that the length of the record
      was at least 5 before subtracting 5 from it.
    
    Note that in both cases, a better solution would be to check the length
    of the data before calling the handler, or immediately upon entry of
    the handler, but this would require significant refactoring.
    
    MFC after:      1 week
    Reported by:    Calif.io in collaboration with Claude and Anthropic Research
    Reported by:    Adam Crosser, Praetorian
    Reviewed by:    markj
    Differential Revision:  https://reviews.freebsd.org/D56215
    
    (cherry picked from commit d0afead876076f605c363f03d92304d1bd75be1c)
---
 sys/fs/cd9660/cd9660_rrip.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/sys/fs/cd9660/cd9660_rrip.c b/sys/fs/cd9660/cd9660_rrip.c
index b7e902b6d9a7..84a779bc9dfc 100644
--- a/sys/fs/cd9660/cd9660_rrip.c
+++ b/sys/fs/cd9660/cd9660_rrip.c
@@ -184,6 +184,8 @@ cd9660_rrip_slink(p,ana)
 			/* Inserting component */
 			wlen = isonum_711(pcomp->clen);
 			inbuf = pcomp->name;
+			if (inbuf + wlen > (char *)pcompe)
+				wlen = ana->maxlen + 1;
 			break;
 		default:
 			printf("RRIP with incorrect flags?");
@@ -257,6 +259,8 @@ cd9660_rrip_altname(p,ana)
 		/* Inserting component */
 		wlen = isonum_711(p->h.length) - 5;
 		inbuf = (char *)p + 5;
+		if (wlen < 0)
+			wlen = ana->maxlen + 1;
 		break;
 
 	default: