libblkid: nvidia_raid: validate checksum

See #1843

Signed-off-by: Thomas Weißschuh <thomas@t-8ch.de>

diff --git a/libblkid/src/superblocks/nvidia_raid.c b/libblkid/src/superblocks/nvidia_raid.c
index 35c663c8d0e41caf86be67992e422dd927f6b722..f59a0e100e5ffaa24326c7ec6b75a5c5880106a4 100644 (file)
--- a/libblkid/src/superblocks/nvidia_raid.c
+++ b/libblkid/src/superblocks/nvidia_raid.c
@@ -27,6 +27,14 @@ struct nv_metadata {
 #define NVIDIA_SUPERBLOCK_SIZE         120
 
 
+static int nvraid_verify_checksum(blkid_probe pr, const struct nv_metadata *nv)
+{
+       uint32_t csum = le32_to_cpu(nv->chksum);
+       for (size_t i = 0; i < le32_to_cpu(nv->size); i++)
+               csum += le32_to_cpu(((uint32_t *) nv)[i]);
+       return blkid_probe_verify_csum(pr, csum, le32_to_cpu(nv->chksum));
+}
+
 static int probe_nvraid(blkid_probe pr,
                const struct blkid_idmag *mag __attribute__((__unused__)))
 {
@@ -42,7 +50,7 @@ static int probe_nvraid(blkid_probe pr,
        nv = (struct nv_metadata *)
                blkid_probe_get_buffer(pr,
                                off,
-                               sizeof(struct nv_metadata));
+                               NVIDIA_SUPERBLOCK_SIZE);
        if (!nv)
                return errno ? -errno : 1;
 
@@ -50,6 +58,8 @@ static int probe_nvraid(blkid_probe pr,
                return 1;
        if (le32_to_cpu(nv->size) * 4 != NVIDIA_SUPERBLOCK_SIZE)
                return 1;
+       if (!nvraid_verify_checksum(pr, nv))
+               return 1;
        if (blkid_probe_sprintf_version(pr, "%u", le16_to_cpu(nv->version)) != 0)
                return 1;
        if (blkid_probe_set_magic(pr, off, sizeof(nv->vendor),