btrfs-progs: dump-super: check array_size in print_sys_chunk_array

[platform/upstream/btrfs-progs.git] / cmds-inspect-dump-super.c

diff --git a/cmds-inspect-dump-super.c b/cmds-inspect-dump-super.c
index ba0d708..b65bd2d 100644 (file)
--- a/cmds-inspect-dump-super.c
+++ b/cmds-inspect-dump-super.c
@@ -34,13 +34,14 @@
 #include "commands.h"
 #include "crc32c.h"
 #include "cmds-inspect-dump-super.h"
+#include "help.h"
 
 static int check_csum_sblock(void *sb, int csum_size)
 {
        u8 result[BTRFS_CSUM_SIZE];
        u32 crc = ~(u32)0;
 
-       crc = btrfs_csum_data(NULL, (char *)sb + BTRFS_CSUM_SIZE,
+       crc = btrfs_csum_data((char *)sb + BTRFS_CSUM_SIZE,
                                crc, BTRFS_SUPER_INFO_SIZE - BTRFS_CSUM_SIZE);
        btrfs_csum_final(crc, result);
 
@@ -64,13 +65,20 @@ static void print_sys_chunk_array(struct btrfs_super_block *sb)
        buf = malloc(sizeof(*buf) + sizeof(*sb));
        if (!buf) {
                error("not enough memory");
-               goto out;
+               return;
        }
        write_extent_buffer(buf, sb, 0, sizeof(*sb));
        array_size = btrfs_super_sys_array_size(sb);
 
        array_ptr = sb->sys_chunk_array;
        sb_array_offset = offsetof(struct btrfs_super_block, sys_chunk_array);
+
+       if (array_size > BTRFS_SYSTEM_CHUNK_ARRAY_SIZE) {
+               error("sys_array_size %u shouldn't exceed %u bytes",
+                               array_size, BTRFS_SYSTEM_CHUNK_ARRAY_SIZE);
+               goto out;
+       }
+
        cur_offset = 0;
        item = 0;
 
@@ -123,8 +131,8 @@ static void print_sys_chunk_array(struct btrfs_super_block *sb)
                item++;
        }
 
-       free(buf);
 out:
+       free(buf);
        return;
 
 out_short_read: