libblkid: bcachefs: limit maximum size of read superblock

diff --git a/libblkid/src/superblocks/bcache.c b/libblkid/src/superblocks/bcache.c
index b40548049696d333ee03bcce6a37029722053957..b66ed8b196a35e70f4c6aff70a4c23d0cf4f8030 100644 (file)
--- a/libblkid/src/superblocks/bcache.c
+++ b/libblkid/src/superblocks/bcache.c
@@ -106,6 +106,8 @@ struct bcachefs_super_block {
 #define BCACHE_SB_CSUMMED_END 208
 /* granularity of offset and length fields within superblock */
 #define BCACHEFS_SECTOR_SIZE   512
+/* maximum superblock size */
+#define BCACHEFS_SB_MAX_SIZE   4096
 /* fields offset within super block */
 #define BCACHEFS_SB_FIELDS_OFF offsetof(struct bcachefs_super_block, _start)
 /* tag value for members field */
@@ -258,6 +260,9 @@ static int probe_bcachefs(blkid_probe pr, const struct blkid_idmag *mag)
                return BLKID_PROBE_NONE;
 
        sb_size = BCACHEFS_SB_FIELDS_OFF + BYTES(bcs);
+       if (sb_size > BCACHEFS_SB_MAX_SIZE)
+               return BLKID_PROBE_NONE;
+
        sb = blkid_probe_get_sb_buffer(pr, mag, sb_size);
        if (!sb)
                return BLKID_PROBE_NONE;