From 10379d600d3f481f03800ac443b102bd1f8c9c4c Mon Sep 17 00:00:00 2001
From: Carter Li <zhangsongcui3371@sina.com>
Date: Sat, 10 Oct 2026 15:42:41 +0800
Subject: [PATCH] Packages (Linux): hardens `getdents64` usage

---
 src/detection/packages/packages.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/detection/packages/packages.c b/src/detection/packages/packages.c
index a1fbdeedc..5f82d50ec 100644
--- a/src/detection/packages/packages.c
+++ b/src/detection/packages/packages.c
@@ -108,6 +108,11 @@ uint32_t ffPackagesGetNumElements(const char* dirname, bool isdir) {
         struct linux_dirent64* entry = (struct linux_dirent64*) bytes;
 
         while (remaining >= nameOffset + 1) {
+            if (entry->d_reclen < nameOffset + 1 || entry->d_reclen > remaining) {
+                remaining = 0;
+                break;
+            }
+
             bool ok = false;
             if (entry->d_name[0] != '.') {
                 if (__builtin_expect(entry->d_type != DT_UNKNOWN && entry->d_type != DT_LNK, true)) {