libblkid: Fix type access in zfs_extract_guid_name

Check if enough space is left for a 32 bit value before parsing it. This
is not a technical out of boundary issue, because due to alignment,
enough bytes are available.

Yet, perform a proper logic check here.

Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>

diff --git a/libblkid/src/superblocks/zfs.c b/libblkid/src/superblocks/zfs.c
index 0bec21d9de45ddb9683f5204accca073f067d4bc..025110af6969268b6eb0562966e7d8a77b7c0ea9 100644 (file)
--- a/libblkid/src/superblocks/zfs.c
+++ b/libblkid/src/superblocks/zfs.c
@@ -223,7 +223,7 @@ static bool zfs_extract_guid_name(blkid_probe pr, void *buf, size_t size, bool f
                                       size, nvp_size));
 
                /* nvpair fits in buffer and name fits in nvpair? */
-               if (nvp_size > size || namesize + sizeof(*nvp) > nvp_size)
+               if (nvp_size > size || namesize + sizeof(*nvp) + 4 > nvp_size)
                        return (false);
 
                DBG(LOWPROBE,