[PATCH] volume_id/iso9660: fix buffer overread in High Sierra detection

Anton Moryakov via busybox <[email protected]> Tue, 26 May 2026 12:01:25 +0300
Newsgroups gmane.linux.busybox
Message-ID <[email protected]>
Static analyzer detected a buffer overread in iso9660 probe:
memcmp(hs->id, "CDROM", 5) reads 5 bytes from a 4-byte array.

The High Sierra volume descriptor actually uses a 5-byte identifier,
but the struct defined id[4] by mistake.

Fix: change id[] size from 4 to 5 to match the actual data being read.

Signed-off-by: Anton Moryakov <[email protected]>
---
 util-linux/volume_id/iso9660.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/util-linux/volume_id/iso9660.c b/util-linux/volume_id/iso9660.c
index c771b01f5..a358fd85c 100644
--- a/util-linux/volume_id/iso9660.c
+++ b/util-linux/volume_id/iso9660.c
@@ -49,7 +49,7 @@ struct iso_volume_descriptor {
 struct high_sierra_volume_descriptor {
 	uint8_t		foo[8];
 	uint8_t		type;
-	uint8_t		id[4];
+	uint8_t		id[5];
 	uint8_t		version;
 } PACKED;
 
-- 
2.39.2