libblkid: (bcache) fix keys usage

References: http://bugs.debian.org/775374
Signed-off-by: Karel Zak <kzak@redhat.com>

diff --git a/libblkid/src/superblocks/bcache.c b/libblkid/src/superblocks/bcache.c
index b3e397ba1efcd0fc33fd4e8f20769905086937fc..4fb16bde2b595885cc7e6f0eff735db066f171d9 100644 (file)
--- a/libblkid/src/superblocks/bcache.c
+++ b/libblkid/src/superblocks/bcache.c
@@ -18,7 +18,7 @@
 #define SB_JOURNAL_BUCKETS 256U
 
 #define node(i, j)         ((i)->d + (j))
-#define end(i)             node(i, (i)->keys)
+#define end(i)             node(i, le16_to_cpu((i)->keys))
 
 static const char bcache_magic[] = {
        0xc6, 0x85, 0x73, 0xf6, 0x4e, 0x1a, 0x45, 0xca,
@@ -108,6 +108,8 @@ static int probe_bcache (blkid_probe pr, const struct blkid_idmag *mag)
 
        if (le64_to_cpu(bcs->offset) != BCACHE_SB_OFF / 512)
                return BLKID_PROBE_NONE;
+       if (le16_to_cpu(bcs->keys) > SB_JOURNAL_BUCKETS)
+               return BLKID_PROBE_NONE;
        if (!blkid_probe_verify_csum(pr, bcache_crc64(bcs), le64_to_cpu(bcs->csum)))
                return BLKID_PROBE_NONE;