Version 3.18.1

Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>

CHANGELOG.md

@@ -7,6 +7,10 @@
     to update the actual links at the bottom of the file.
 -->
 
+### Version 3.18.1
+
+* Fix output file corruption in `avbroot sparse unpack` when unpacking a sparse file with holes larger than 2^32 ([Issue #472], [PR #476])
+
 ### Version 3.18.0
 
 * Make OTA metadata property file field validation more lenient ([Issue #469], [PR #470])
@@ -381,6 +385,7 @@ Behind-the-scenes changes:
 [Issue #441]: https://github.com/chenxiaolong/avbroot/issues/441
 [Issue #451]: https://github.com/chenxiaolong/avbroot/issues/451
 [Issue #469]: https://github.com/chenxiaolong/avbroot/issues/469
+[Issue #472]: https://github.com/chenxiaolong/avbroot/issues/472
 [PR #130]: https://github.com/chenxiaolong/avbroot/pull/130
 [PR #132]: https://github.com/chenxiaolong/avbroot/pull/132
 [PR #133]: https://github.com/chenxiaolong/avbroot/pull/133
@@ -552,3 +557,4 @@ Behind-the-scenes changes:
 [PR #473]: https://github.com/chenxiaolong/avbroot/pull/473
 [PR #474]: https://github.com/chenxiaolong/avbroot/pull/474
 [PR #475]: https://github.com/chenxiaolong/avbroot/pull/475
+[PR #476]: https://github.com/chenxiaolong/avbroot/pull/476

Cargo.lock

@@ -113,7 +113,7 @@ checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
 
 [[package]]
 name = "avbroot"
-version = "3.18.0"
+version = "3.18.1"
 dependencies = [
  "anyhow",
  "assert_matches",
@@ -567,7 +567,7 @@ checksum = "ecb08c4819242b1ec89b3d0c6affa229005bef46ae4f7eed8b80768187c10087"
 
 [[package]]
 name = "e2e"
-version = "3.18.0"
+version = "3.18.1"
 dependencies = [
  "anyhow",
  "avbroot",
@@ -662,7 +662,7 @@ dependencies = [
 
 [[package]]
 name = "fuzz"
-version = "3.18.0"
+version = "3.18.1"
 dependencies = [
  "avbroot",
  "honggfuzz",
@@ -2226,7 +2226,7 @@ dependencies = [
 
 [[package]]
 name = "xtask"
-version = "3.18.0"
+version = "3.18.1"
 dependencies = [
  "anyhow",
  "clap",

Cargo.toml

@@ -4,7 +4,7 @@ members = ["avbroot", "e2e", "fuzz", "xtask"]
 resolver = "2"
 
 [workspace.package]
-version = "3.18.0"
+version = "3.18.1"
 license = "GPL-3.0-only"
 edition = "2024"
 repository = "https://github.com/chenxiaolong/avbroot"

avbroot/src/cli/sparse.rs

@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: 2024 Andrew Gunnerson
+// SPDX-FileCopyrightText: 2024-2025 Andrew Gunnerson
 // SPDX-License-Identifier: GPL-3.0-only
 
 use std::{
@@ -317,11 +317,11 @@ fn unpack_subcommand(
                 })?;
             }
             ChunkData::Hole => {
-                // This cannot overflow.
-                let to_skip = chunk.bounds.len() * metadata.header.block_size;
+                // Unlike ChunkData::Data, this can overflow a u32.
+                let to_skip = i64::from(chunk.bounds.len()) * i64::from(metadata.header.block_size);
 
                 writer
-                    .seek(SeekFrom::Current(to_skip.into()))
+                    .seek(SeekFrom::Current(to_skip))
                     .with_context(|| format!("Failed to seek file: {:?}", cli.output))?;
             }
             ChunkData::Crc32(_) => {}

avbroot/src/format/sparse.rs

@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: 2024 Andrew Gunnerson
+// SPDX-FileCopyrightText: 2024-2025 Andrew Gunnerson
 // SPDX-License-Identifier: GPL-3.0-only
 
 use std::{
@@ -374,6 +374,9 @@ impl fmt::Debug for ChunkData {
 /// metadata they contain.
 #[derive(Clone, Copy, PartialEq, Eq)]
 pub struct Chunk {
+    /// When [`Self::data`] is [`ChunkData::Data`], this is guaranteed to not
+    /// exceed the bounds of [`u32`] when multiplied by [`Header::block_size`].
+    /// For other types of data, a 64-bit signed or unsigned integer is needed.
     pub bounds: ChunkBounds,
     pub data: ChunkData,
 }