File a486f88d-CVE-2025-47712.patch of Package nbdkit.38731

commit a486f88d1eea653ea88b0bf8804c4825dab25ec7
Author: Eric Blake <eblake@redhat.com>
Date:   Tue Apr 22 19:53:39 2025 -0500

    blocksize: Fix 32-bit overflow in .extents [CVE-2025-47712]
    
    If the original request is larger than 2**32 - minblock, then we were
    calling nbdkit_extents_aligned() with a count that rounded up then
    overflowed to 0 instead of the intended 4G because of overflowing a
    32-bit type, which in turn causes an assertion failure:
    
    nbdkit: ../../server/backend.c:814: backend_extents: Assertion `backend_valid_range (c, offset, count)' failed.
    
    The fix is to force the rounding to be in a 64-bit type from the
    get-go.
    
    The ability for a well-behaved client to cause the server to die from
    an assertion failure can be used as a denial of service attack against
    other clients.  Mitigations: if you requrire the use of TLS, then you
    can ensure that you only have trusted clients that won't trigger a
    block status call that large.  Also, the problem only occurs when
    using the blocksize filter, although setting the filter's maxlen
    parameter to a smaller value than its default of 2**32-1 does not
    help.
    
    Fixes: 2680be00 ('blocksize: Fix .extents when plugin changes type within minblock', v1.21.16)
    Signed-off-by: Eric Blake <eblake@redhat.com>
    Message-ID: <20250423210917.1784789-3-eblake@redhat.com>
    Reviewed-by: Richard W.M. Jones <rjones@redhat.com>

Index: nbdkit-1.36.5/filters/blocksize/blocksize.c
===================================================================
--- nbdkit-1.36.5.orig/filters/blocksize/blocksize.c
+++ nbdkit-1.36.5/filters/blocksize/blocksize.c
@@ -482,8 +482,9 @@ blocksize_extents (nbdkit_next *next,
     return -1;
   }
 
-  if (nbdkit_extents_aligned (next, MIN (ROUND_UP (count, h->minblock),
-                                         h->maxlen),
+  if (nbdkit_extents_aligned (next,
+                              MIN (ROUND_UP ((uint64_t) count, h->minblock),
+                                   h->maxlen),
                               ROUND_DOWN (offset, h->minblock), flags,
                               h->minblock, extents2, err) == -1)
     return -1;