From: Karel Zak <kzak@redhat.com>
Date: Thu, 15 Jan 2015 10:56:27 +0000 (+0100)
Subject: libblkid: (bcache) fix keys usage
X-Git-Tag: v2.26-rc2~93
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=861b11d5e24c5db463463fb6c047e72456597a5b;p=thirdparty%2Futil-linux.git

libblkid: (bcache) fix keys usage

References: http://bugs.debian.org/775374
Signed-off-by: Karel Zak <kzak@redhat.com>
---

diff --git a/libblkid/src/superblocks/bcache.c b/libblkid/src/superblocks/bcache.c
index b3e397ba1e..4fb16bde2b 100644
--- a/libblkid/src/superblocks/bcache.c
+++ b/libblkid/src/superblocks/bcache.c
@@ -18,7 +18,7 @@
 #define SB_JOURNAL_BUCKETS 256U
 
 #define node(i, j)         ((i)->d + (j))
-#define end(i)             node(i, (i)->keys)
+#define end(i)             node(i, le16_to_cpu((i)->keys))
 
 static const char bcache_magic[] = {
 	0xc6, 0x85, 0x73, 0xf6, 0x4e, 0x1a, 0x45, 0xca,
@@ -108,6 +108,8 @@ static int probe_bcache (blkid_probe pr, const struct blkid_idmag *mag)
 
 	if (le64_to_cpu(bcs->offset) != BCACHE_SB_OFF / 512)
 		return BLKID_PROBE_NONE;
+	if (le16_to_cpu(bcs->keys) > SB_JOURNAL_BUCKETS)
+		return BLKID_PROBE_NONE;
 	if (!blkid_probe_verify_csum(pr, bcache_crc64(bcs), le64_to_cpu(bcs->csum)))
 		return BLKID_PROBE_NONE;