libblkid: bcachefs: validate size of member field

diff --git a/libblkid/src/superblocks/bcache.c b/libblkid/src/superblocks/bcache.c
index 90e7ef250f9eacf6b8d5130e8fa0140a88ebf351..24805173142746610519ae1edae08696f94b4991 100644 (file)
--- a/libblkid/src/superblocks/bcache.c
+++ b/libblkid/src/superblocks/bcache.c
@@ -161,14 +161,18 @@ static void probe_bcachefs_sb_members(blkid_probe pr,
        uint64_t sectors = 0;
        uint8_t i;
 
-       if (member_field_end(members, dev_idx) > sb_end)
+       if ((unsigned char *) field + BYTES(field)
+                       != member_field_end(members, bcs->nr_devices))
                return;
 
-       blkid_probe_set_uuid_as(pr, members->members[dev_idx].uuid, "UUID_SUB");
+       if (member_field_end(members, dev_idx) > sb_end)
+               return;
 
        if (member_field_end(members, bcs->nr_devices - 1) > sb_end)
                return;
 
+       blkid_probe_set_uuid_as(pr, members->members[dev_idx].uuid, "UUID_SUB");
+
        for (i = 0; i < bcs->nr_devices; i++) {
                struct bcachefs_sb_member *member = &members->members[i];
                sectors += le64_to_cpu(member->nbuckets) * le16_to_cpu(member->bucket_size);