[rpms/parted] f44: - parted: Fix partition number allocation in do_print (bcl)

[rpms/parted] f44: - parted: Fix partition number allocation in do_print (bcl)

[Brian C. Lane]

            A new commit has been pushed.

            Repo   : rpms/parted
            Branch : f44
            Commit : 06583e26e5ce4ce5fa941f042b4ba1fd4c62b40d
            Author : Brian C. Lane <bcl@redhat.com>
            Date   : 2026-09-14T16:01:46-07:00
            Stats  : +376/-1 in 6 file(s)
            URL    : https://src.fedoraproject.org/rpms/parted/c/06583e26e5ce4ce5fa941f042b4ba1fd4c62b40d?branch=f44

            Log:
            - parted: Fix partition number allocation in do_print (bcl)
- fdasd: Make sure data set name is positive (bcl)
- resize: Make sure hfsc_new_cachetable cannot overflow on 32bit (bcl)
- resize: Make sure 32bit build cannot overflow frag_count (bcl)
- libparted: Catch FAT metadata triggered errors (bcl)
  Resolves: CVE-2026-89085
  Resolves: CVE-2026-89088

---
diff --git a/0013-libparted-Catch-FAT-metadata-triggered-errors.patch b/0013-libparted-Catch-FAT-metadata-triggered-errors.patch
new file mode 100644
index 0000000..684e999
--- /dev/null
+++ b/0013-libparted-Catch-FAT-metadata-triggered-errors.patch
@@ -0,0 +1,227 @@
+From cec16950d9aa02e7c402ff096a4567fd211cdaf0 Mon Sep 17 00:00:00 2001
+From: "Brian C. Lane" <bcl@redhat.com>
+Date: Tue, 8 Sep 2026 09:13:00 -0700
+Subject: [PATCH 13/17] libparted: Catch FAT metadata triggered errors
+
+Bad metadata can trigger a buffer overflow in fat resize code. Trigger
+an assert when the sector count is too large, or malloc is called with a
+size of 0
+
+Adds a new test that checks to make sure that the assert is triggered.
+This includes a test for deep directory traversal which should be caught
+by glibc and reported as 'buffer overflow detected'.
+
+This also includes a check on the flag_traverse_dir dir_name length to
+prevent an overflow of the 4k buffer with deeply nested directories.
+Also include a test for this assertion.
+
+WARNING: parted should be build with debug enabled (which is the
+default) this enables a large number of PED_ASSERT checks which catch
+various conditions like these.
+
+This fixes two CVE's:
+ - CVE-2026-89085 - heap buffer overflow in _init_fats / fat_table_read
+ - CVE-2026-89088 - heap buffer overflow in duplicate_legacy_root_dir
+
+(cherry picked from commit 73301c6915781c2eee66d0b1cc9d41a70bf901d6)
+---
+ libparted/fs/r/fat/count.c  |   1 +
+ libparted/fs/r/fat/resize.c |   2 +
+ libparted/libparted.c       |   1 +
+ tests/Makefile.am           |   1 +
+ tests/t3001-buffer.sh       | 134 ++++++++++++++++++++++++++++++++++++
+ 5 files changed, 139 insertions(+)
+ create mode 100755 tests/t3001-buffer.sh
+
+diff --git a/libparted/fs/r/fat/count.c b/libparted/fs/r/fat/count.c
+index e23404b2..9c97bf42 100644
+--- a/libparted/fs/r/fat/count.c
++++ b/libparted/fs/r/fat/count.c
+@@ -166,6 +166,7 @@ flag_traverse_dir (FatTraverseInfo* trav_info) {
+ 	PedSector		size;
+ 
+ 	PED_ASSERT (trav_info != NULL);
++	PED_ASSERT (strlen(trav_info->dir_name) < 4083);
+ 
+ 	strcpy (file_name, trav_info->dir_name);
+ 	file_name_start = file_name + strlen (file_name);
+diff --git a/libparted/fs/r/fat/resize.c b/libparted/fs/r/fat/resize.c
+index 78dede43..a6cc3851 100644
+--- a/libparted/fs/r/fat/resize.c
++++ b/libparted/fs/r/fat/resize.c
+@@ -86,6 +86,8 @@ duplicate_legacy_root_dir (FatOpContext* ctx)
+ 
+ 	PED_ASSERT (old_fs_info->root_dir_sector_count
+ 			== new_fs_info->root_dir_sector_count);
++        PED_ASSERT (old_fs_info->root_dir_sector_count <= old_fs_info->buffer_sectors);
++        PED_ASSERT (new_fs_info->root_dir_sector_count <= new_fs_info->buffer_sectors);
+ 
+ 	if (!ped_geometry_read (ctx->old_fs->geom, old_fs_info->buffer,
+ 				old_fs_info->root_dir_offset,
+diff --git a/libparted/libparted.c b/libparted/libparted.c
+index 204ce007..6bc30954 100644
+--- a/libparted/libparted.c
++++ b/libparted/libparted.c
+@@ -241,6 +241,7 @@ ped_malloc (size_t size)
+ {
+ 	void*		mem;
+ 
++        PED_ASSERT(size > 0);
+ 	mem = (void*) malloc (size);
+ 	if (!mem) {
+ 		ped_exception_throw (PED_EXCEPTION_FATAL, PED_EXCEPTION_CANCEL,
+diff --git a/tests/Makefile.am b/tests/Makefile.am
+index 5eeab08e..af08ac0e 100644
+--- a/tests/Makefile.am
++++ b/tests/Makefile.am
+@@ -59,6 +59,7 @@ TESTS = \
+   t2410-dos-udf-partition-type.sh \
+   t2500-probe-corrupt-hfs.sh \
+   t3000-resize-fs.sh \
++  t3001-buffer.sh \
+   t3200-resize-partition.sh \
+   t3200-type-change.sh \
+   t3210-gpt-type-change.sh \
+diff --git a/tests/t3001-buffer.sh b/tests/t3001-buffer.sh
+new file mode 100755
+index 00000000..c016f5f7
+--- /dev/null
++++ b/tests/t3001-buffer.sh
+@@ -0,0 +1,134 @@
++#!/bin/sh
++# Test buffer overflow fix in libparted/fs/r/fat/fat.c
++
++# Copyright (C) 2026 Free Software Foundation, Inc.
++
++# This program is free software; you can redistribute it and/or modify
++# it under the terms of the GNU General Public License as published by
++# the Free Software Foundation; either version 3 of the License, or
++# (at your option) any later version.
++
++# This program is distributed in the hope that it will be useful,
++# but WITHOUT ANY WARRANTY; without even the implied warranty of
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++# GNU General Public License for more details.
++
++# You should have received a copy of the GNU General Public License
++# along with this program.  If not, see <http://www.gnu.org/licenses/>.
++
++. "${srcdir=.}/init.sh"; path_prepend_ ../parted .
++require_root_
++require_scsi_debug_module_
++require_512_byte_sector_size_
++
++
++FSTYPES=""
++
++# Is mkfs.vfat available?
++mkfs.vfat 2>&1 | grep '^Usage:' && FSTYPES="fat32 fat16"
++
++[ -n "$FSTYPES" ] || skip_ "mkfs.vfat is not installed"
++
++
++ss=$sector_size_
++
++start=63s
++default_end=546147s
++    new_end=530144s
++
++# create memory-backed device. Must be > 256MB+8MB
++scsi_debug_setup_ dev_size_mb=267 > dev-name ||
++  skip_ 'failed to create scsi_debug device'
++dev=$(cat dev-name)
++
++fail=0
++
++parted -s $dev mklabel gpt > out 2>&1 || fail=1
++# expect no output
++compare /dev/null out || fail=1
++
++# ensure that the disk is large enough
++dev_n_sectors=$(parted -s $dev u s p|sed -n '2s/.* \([0-9]*\)s$/\1/p')
++device_sectors_required=$(echo $default_end | sed 's/s$//')
++# Ensure that $dev is large enough for this test
++test $device_sectors_required -le $dev_n_sectors || fail=1
++
++# create mount point dir
++mount_point="`pwd`/mnt"
++mkdir "$mount_point" || fail=1
++
++# be sure to unmount upon interrupt, failure, etc.
++cleanup_fn_() { umount "${dev}1" > /dev/null 2>&1; }
++
++for fs_type in $FSTYPES; do
++  echo "fs_type=$fs_type"
++
++  # create an empty $fs_type partition, cylinder aligned, size > 256 MB
++  parted -a min -s $dev mkpart p1 $start $default_end > out 2>&1 || fail=1
++  compare /dev/null out || fail=1
++
++  # print partition table
++  parted -m -s $dev u s p > out 2>&1 || fail=1
++
++  # wait for new partition device to appear
++  wait_for_dev_to_appear_ ${dev}1
++
++  case $fs_type in
++    fat16) mkfs_cmd='mkfs.vfat -F 16'; fsck='fsck.vfat -v';;
++    fat32) mkfs_cmd='mkfs.vfat -F 32'; fsck='fsck.vfat -v';;
++    *) error "internal error: unhandled fs type: $fs_type";;
++  esac
++
++  # create the file system
++  $mkfs_cmd ${dev}1 || fail=1
++
++  # Set a very large dir_entries value
++  # This triggeres different failures in FAT16 and FAT32, see expected output below
++  printf '\xff\xff' | dd of=${dev}1 bs=1 seek=$((0x11)) conv=notrunc
++
++  # NOTE: shrinking is the only type of resizing that works.
++  # resize that file system to be one cylinder (8MiB) smaller
++  # NOTE: A core dump is expected here, check output to determine if it is the correct failure
++  fs-resize ${dev}1 0 $new_end > out 2>&1
++
++  # Include full output for debugging
++  cat out
++
++  # FAT16 exepcts an Assert in duplicate_legacy_root_dir
++  # FAT32 expects an Assert in ped_malloc
++  case $fs_type in
++    fat16) grep "Assertion.*duplicate_legacy_root_dir" out || fail=1;;
++    fat32) grep "Assertion.*ped_malloc" out || fail=1;;
++  esac
++
++  # create a clean file system
++  $mkfs_cmd ${dev}1 || fail=1
++
++  # create 500 deep directory tree that overflows the 4096 byte tmp_buffer
++  # to catch core dump in libparted/fs/r/fat/count.c flag_traverse_dir()
++  mount "${dev}1" "$mount_point" || fail=1
++  cat /dev/null > exp
++  ( cd "$mount_point"; for d in `seq 500`; do mkdir TESTDIRR.DIR; cd TESTDIRR.DIR; done ) > out
++  compare exp out || fail=1   # Ensure no errors creating directory tree
++  umount "${dev}1" || fail=1
++
++  # Make sure that buffer overflow is caught
++  fs-resize ${dev}1 0 $new_end > out 2>&1
++
++  # Include full output for debugging
++  cat out
++
++  # Confirm that the large dir_name was caught
++  grep "Assertion.*strlen.*flag_traverse_dir" out || fail=1
++
++  # Remove the partition explicitly, so that mklabel doesn't evoke a warning.
++  parted -s $dev rm 1 || fail=1
++
++  # Create a clean partition table for the next iteration.
++  parted -s $dev mklabel gpt > out 2>&1 || fail=1
++  # expect no output
++  compare /dev/null out || fail=1
++
++done
++
++Exit $fail
+-- 
+2.55.0
+

diff --git a/0014-resize-Make-sure-32bit-build-cannot-overflow-frag_co.patch b/0014-resize-Make-sure-32bit-build-cannot-overflow-frag_co.patch
new file mode 100644
index 0000000..b9bb78f
--- /dev/null
+++ b/0014-resize-Make-sure-32bit-build-cannot-overflow-frag_co.patch
@@ -0,0 +1,31 @@
+From 709052ac8ea0fa9dad2705d77f4d9bc1b259fff4 Mon Sep 17 00:00:00 2001
+From: "Brian C. Lane" <bcl@redhat.com>
+Date: Wed, 9 Sep 2026 16:47:58 -0700
+Subject: [PATCH 14/17] resize: Make sure 32bit build cannot overflow
+ frag_count
+
+Add a couple of PED_ASSERT checks to fat_op_context_new that make sure
+the frag_count value can be allocated. Does not effect 64bit
+architectures.
+
+(cherry picked from commit f3ff7ede4f3832f6e2876cf0440bdc3f324e85fa)
+---
+ libparted/fs/r/fat/context.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/libparted/fs/r/fat/context.c b/libparted/fs/r/fat/context.c
+index c7823236..acae57d0 100644
+--- a/libparted/fs/r/fat/context.c
++++ b/libparted/fs/r/fat/context.c
+@@ -96,6 +96,8 @@ fat_op_context_new (PedFileSystem* new_fs, PedFileSystem* old_fs)
+ 	if (!ctx->buffer_map)
+ 		goto error_free_ctx;
+ 
++        PED_ASSERT (old_fs_info->frag_count > 0);
++        PED_ASSERT ((size_t) old_fs_info->frag_count < SIZE_MAX / sizeof (FatFragment));
+ 	ctx->remap = (FatFragment*) ped_malloc (sizeof (FatFragment)
+ 						   * old_fs_info->frag_count);
+ 	if (!ctx->remap)
+-- 
+2.55.0
+

diff --git a/0015-resize-Make-sure-hfsc_new_cachetable-cannot-overflow.patch b/0015-resize-Make-sure-hfsc_new_cachetable-cannot-overflow.patch
new file mode 100644
index 0000000..89a2705
--- /dev/null
+++ b/0015-resize-Make-sure-hfsc_new_cachetable-cannot-overflow.patch
@@ -0,0 +1,30 @@
+From 7d65e00517a8329a44662e3a727311c2d465f974 Mon Sep 17 00:00:00 2001
+From: "Brian C. Lane" <bcl@redhat.com>
+Date: Thu, 10 Sep 2026 13:04:04 -0700
+Subject: [PATCH 15/17] resize: Make sure hfsc_new_cachetable cannot overflow
+ on 32bit
+
+Add a couple of PED_ASSERT checks on size to make sure the ped_malloc
+call doesn't allocate less than expected.
+
+(cherry picked from commit 67f9b5ff586ee9ae6682d86773d1fa6aa41d50b8)
+---
+ libparted/fs/r/hfs/cache.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/libparted/fs/r/hfs/cache.c b/libparted/fs/r/hfs/cache.c
+index 255f1fda..17a181e1 100644
+--- a/libparted/fs/r/hfs/cache.c
++++ b/libparted/fs/r/hfs/cache.c
+@@ -49,6 +49,8 @@ hfsc_new_cachetable(unsigned int size)
+ 	ret->table_size = size;
+ 	ret->table_first_free = 0;
+ 
++        PED_ASSERT (size > 0);
++        PED_ASSERT ((size_t) size * sizeof(*ret->table) < SIZE_MAX);
+ 	ret->table = ped_malloc(sizeof(*ret->table)*size);
+ 	if (!ret->table) { free(ret); return NULL; }
+ 	memset(ret->table, 0, sizeof(*ret->table)*size);
+-- 
+2.55.0
+

diff --git a/0016-fdasd-Make-sure-data-set-name-is-positive.patch b/0016-fdasd-Make-sure-data-set-name-is-positive.patch
new file mode 100644
index 0000000..e466aa3
--- /dev/null
+++ b/0016-fdasd-Make-sure-data-set-name-is-positive.patch
@@ -0,0 +1,43 @@
+From 069915c3ae22ea7fdf4ce640cc0e02062e7044ff Mon Sep 17 00:00:00 2001
+From: "Brian C. Lane" <bcl@redhat.com>
+Date: Fri, 11 Sep 2026 15:21:11 -0700
+Subject: [PATCH 16/17] fdasd: Make sure data set name is positive
+
+Passing a negative value, eg. PART-999, to atoi could result in passing
+a negative value to the setpos call when it writes f1_counter.
+
+This adds an exception check to ensure the result of the atoi is always
+positive, and it preserves the rest of the logic which depends on n being
+1 less than the value.
+
+(cherry picked from commit a5cd8539475f904d6d46bf85998af2535d095555)
+---
+ libparted/labels/fdasd.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/libparted/labels/fdasd.c b/libparted/labels/fdasd.c
+index cee4d461..ea00e664 100644
+--- a/libparted/labels/fdasd.c
++++ b/libparted/labels/fdasd.c
+@@ -18,6 +18,7 @@
+ 
+ #include <config.h>
+ #include <arch/linux.h>
++#include <parted/debug.h>
+ #include <parted/vtoc.h>
+ #include <parted/device.h>
+ #include <parted/fdasd.h>
+@@ -697,7 +698,9 @@ fdasd_process_valid_vtoc (fdasd_anchor_t * anc, unsigned long b, int fd)
+ 				if (ch != NULL) {
+ 					strncpy (s, ch + 4, 4);
+ 					s[4] = '\0';
+-					n = atoi (s) - 1;
++					n = atoi (s);
++                                        PED_ASSERT (n >= 0);
++                                        n = n - 1;
+ 				}
+ 
+ 				vtoc_ebcdic_enc (p->f1->DS1DSNAM, p->f1->DS1DSNAM, 44);
+-- 
+2.55.0
+

diff --git a/0017-parted-Fix-partition-number-allocation-in-do_print.patch b/0017-parted-Fix-partition-number-allocation-in-do_print.patch
new file mode 100644
index 0000000..02e5f13
--- /dev/null
+++ b/0017-parted-Fix-partition-number-allocation-in-do_print.patch
@@ -0,0 +1,30 @@
+From 953999966b80168634319109ce5ae3d6cec1839c Mon Sep 17 00:00:00 2001
+From: "Brian C. Lane" <bcl@redhat.com>
+Date: Fri, 11 Sep 2026 16:58:59 -0700
+Subject: [PATCH 17/17] parted: Fix partition number allocation in do_print
+
+GPT can have up to 8192 partitions, but we only allocate 4 bytes (two of
+which are for a space and a \0). Increase this to 6 so that more than 99
+partitions doesn't overflow the temporary variable.
+
+(cherry picked from commit 03c20a91d6960bf1ad817cc28624bbb2d1f91eaa)
+---
+ parted/parted.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/parted/parted.c b/parted/parted.c
+index fc2aeba1..d91a689c 100644
+--- a/parted/parted.c
++++ b/parted/parted.c
+@@ -1414,7 +1414,7 @@ do_print (PedDevice** dev, PedDisk** diskp)
+                         part->type & PED_PARTITION_METADATA)
+                             continue;
+ 
+-                    tmp = ped_malloc (4);
++                    tmp = ped_malloc (6);
+ 
+                     if (part->num >= 0)
+                             sprintf (tmp, "%2d ", part->num);
+-- 
+2.55.0
+

diff --git a/parted.spec b/parted.spec
index 1b78da9..7e0cf96 100644
--- a/parted.spec
+++ b/parted.spec
@@ -1,7 +1,7 @@
 Summary: The GNU disk partition manipulation program
 Name:    parted
 Version: 3.6
-Release: 14%{?dist}
+Release: 15%{?dist}
 License: GPL-3.0-or-later
 URL:     http://www.gnu.org/software/parted
 
@@ -22,6 +22,11 @@ Patch0009: 0009-tests-probing-ext4-without-journal-should-still-indi.patch
 Patch0010: 0010-libparted-Do-not-detect-ext4-without-journal-as-ext2.patch
 Patch0011: 0011-nilfs2-Fixed-possible-sigsegv-in-case-of-corrupted-s.patch
 Patch0012: 0012-doc-Fix-some-groff-mandoc-linting-complaints.patch
+Patch0013: 0013-libparted-Catch-FAT-metadata-triggered-errors.patch
+Patch0014: 0014-resize-Make-sure-32bit-build-cannot-overflow-frag_co.patch
+Patch0015: 0015-resize-Make-sure-hfsc_new_cachetable-cannot-overflow.patch
+Patch0016: 0016-fdasd-Make-sure-data-set-name-is-positive.patch
+Patch0017: 0017-parted-Fix-partition-number-allocation-in-do_print.patch
 
 BuildRequires: gcc
 BuildRequires: e2fsprogs-devel
@@ -126,6 +131,15 @@ make check
 
 
 %changelog
+* Mon Sep 14 2026 Brian C. Lane <bcl@redhat.com> - 3.6-15
+- parted: Fix partition number allocation in do_print (bcl)
+- fdasd: Make sure data set name is positive (bcl)
+- resize: Make sure hfsc_new_cachetable cannot overflow on 32bit (bcl)
+- resize: Make sure 32bit build cannot overflow frag_count (bcl)
+- libparted: Catch FAT metadata triggered errors (bcl)
+  Resolves: CVE-2026-89085
+  Resolves: CVE-2026-89088
+
 * Fri Jan 16 2026 Fedora Release Engineering <releng@fedoraproject.org> - 3.6-14
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild