From 1355e2d49570cc9029a43e24bd04993749dc6001 Mon Sep 17 00:00:00 2001
From: mlarkin <mlarkin@openbsd.org>
Date: Sat, 30 May 2026 07:24:46 +0000
Subject: [PATCH] Prevent overread when reading the chunktable in unhibernate

Ensure we don't read past the end of the chunktable, which could happen
with a tampered or corrupted on-disk hibernate image.

Reported by Frank Denis
---
 sys/kern/subr_hibernate.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/sys/kern/subr_hibernate.c b/sys/kern/subr_hibernate.c
index a21c330c99c..ca2db8fe451 100644
--- a/sys/kern/subr_hibernate.c
+++ b/sys/kern/subr_hibernate.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: subr_hibernate.c,v 1.155 2026/02/11 22:34:41 deraadt Exp $	*/
+/*	$OpenBSD: subr_hibernate.c,v 1.156 2026/05/30 07:24:46 mlarkin Exp $	*/
 
 /*
  * Copyright (c) 2011 Ariane van der Steldt <ariane@stack.nl>
@@ -1714,6 +1714,11 @@ hibernate_read_image(union hibernate_info *hib)
 	compressed_size = 0;
 
 	chunks = (struct hibernate_disk_chunk *)chunktable;
+	if (hib->chunk_ctr > (HIBERNATE_CHUNK_TABLE_SIZE /
+	    sizeof(struct hibernate_disk_chunk))) {
+		status = 1;
+		goto unmap;
+	}
 
 	for (i = 0; i < hib->chunk_ctr; i++)
 		compressed_size += chunks[i].compressed_size;