From: Thomas Weißschuh Date: Sun, 22 Jan 2023 01:52:29 +0000 (+0000) Subject: libblkid: bcachefs: validate size of member field X-Git-Tag: v2.39-rc1~140 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=d9c72ffc4c3726790789e1b88688a525b02a3905;p=thirdparty%2Futil-linux.git libblkid: bcachefs: validate size of member field --- diff --git a/libblkid/src/superblocks/bcache.c b/libblkid/src/superblocks/bcache.c index 90e7ef250f..2480517314 100644 --- a/libblkid/src/superblocks/bcache.c +++ b/libblkid/src/superblocks/bcache.c @@ -161,14 +161,18 @@ static void probe_bcachefs_sb_members(blkid_probe pr, uint64_t sectors = 0; uint8_t i; - if (member_field_end(members, dev_idx) > sb_end) + if ((unsigned char *) field + BYTES(field) + != member_field_end(members, bcs->nr_devices)) return; - blkid_probe_set_uuid_as(pr, members->members[dev_idx].uuid, "UUID_SUB"); + if (member_field_end(members, dev_idx) > sb_end) + return; if (member_field_end(members, bcs->nr_devices - 1) > sb_end) return; + blkid_probe_set_uuid_as(pr, members->members[dev_idx].uuid, "UUID_SUB"); + for (i = 0; i < bcs->nr_devices; i++) { struct bcachefs_sb_member *member = &members->members[i]; sectors += le64_to_cpu(member->nbuckets) * le16_to_cpu(member->bucket_size);